[ python-Bugs-1238681 ] freed pointer is used in longobject.c:long_pow()

[SourceForge.net]

Bugs item #1238681, was opened at 2005-07-15 01:06
Message generated for change (Comment added) made by tim_one
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1238681&group_id=5470

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Python Interpreter Core
Group: Python 2.4
>Status: Closed
>Resolution: Fixed
Priority: 7
Submitted By: Luke (luked)
Assigned to: Tim Peters (tim_one)
Summary: freed pointer is used in longobject.c:long_pow()

Initial Comment:
See in the following code snippet (from the end of the
long_pow function in longobject.c) that "b" is used
after it has been freed:

 Done:
        Py_XDECREF(a);
        Py_XDECREF(b);
        Py_XDECREF(c);
        Py_XDECREF(temp);
        if (b->ob_size > FIVEARY_CUTOFF) {
                for (i = 0; i < 32; ++i)
                        Py_XDECREF(table[i]);
        }
        return (PyObject *)z;
}

The error exists in 2.4.1 and on CVS trunk.


----------------------------------------------------------------------

>Comment By: Tim Peters (tim_one)
Date: 2005-07-17 19:47

Message:
Logged In: YES 
user_id=31435

Eww -- gross.  Thanks for the report!  Repaired (along with a 
another long_pow() coding error) in:

Misc/NEWS 1.1319
Objects/longobject.c 1.169

----------------------------------------------------------------------

Comment By: Raymond Hettinger (rhettinger)
Date: 2005-07-15 01:26

Message:
Logged In: YES 
user_id=80475

Tim, I believe this one belongs to you (checkin 1.163 on
8/30/2004).

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1238681&group_id=5470