Skip to content

Commit 51e3e45

Browse files
authored
bpo-40020: Fix realloc leak on failure in growable_comment_array_add (GH-19083)
Fix a leak and subsequent crash in parsetok.c caused by realloc misuse on a rare codepath. Realloc returns a null pointer on failure, and then growable_comment_array_deallocate crashes later when it dereferences it.
1 parent fc2d8d6 commit 51e3e45

File tree

2 files changed

+6
-3
lines changed

2 files changed

+6
-3
lines changed
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Fix a leak and subsequent crash in parsetok.c caused by realloc misuse on a rare codepath.

Parser/parsetok.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,13 @@ growable_comment_array_init(growable_comment_array *arr, size_t initial_size) {
3737
static int
3838
growable_comment_array_add(growable_comment_array *arr, int lineno, char *comment) {
3939
if (arr->num_items >= arr->size) {
40-
arr->size *= 2;
41-
arr->items = realloc(arr->items, arr->size * sizeof(*arr->items));
42-
if (!arr->items) {
40+
size_t new_size = arr->size * 2;
41+
void *new_items_array = realloc(arr->items, new_size * sizeof(*arr->items));
42+
if (!new_items_array) {
4343
return 0;
4444
}
45+
arr->items = new_items_array;
46+
arr->size = new_size;
4547
}
4648

4749
arr->items[arr->num_items].lineno = lineno;

0 commit comments

Comments
 (0)