[Python-checkins] [3.7] Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304) (GH-13495)

[Ned Deily]

https://github.com/python/cpython/commit/3708316afa061dc6c1c6a1207f4998974cfa0752
commit: 3708316afa061dc6c1c6a1207f4998974cfa0752
branch: 3.7
author: Petr Viktorin <encukou at gmail.com>
committer: Ned Deily <nad at python.org>
date: 2019-05-28T23:35:33-04:00
summary:

[3.7] Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304) (GH-13495)

If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(),
PyObject_Free() would be called on a static string in type_dealloc().
(cherry picked from commit 0613c1e481440aa8f54ba7f6056924c175fbcc13)

Co-authored-by: Zackery Spytz <zspytz at gmail.com>

files:
M Objects/typeobject.c

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 3092e98f6b25..7065ee518e5c 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2960,6 +2960,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
             size_t len = strlen(old_doc)+1;
             char *tp_doc = PyObject_MALLOC(len);
             if (tp_doc == NULL) {
+                type->tp_doc = NULL;
                 PyErr_NoMemory();
                 goto fail;
             }