➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: freed pointer is used in longobject.c:long_pow()
Type: Stage:
Components: Interpreter Core Versions: Python 2.4
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: tim.peters Nosy List: georg.brandl, luked, rhettinger, tim.peters
Priority: high Keywords:

Created on 2005-07-15 05:06 by luked, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Messages (4)
msg25815 - (view) Author: Luke (luked) Date: 2005-07-15 05:06 
See in the following code snippet (from the end of the
long_pow function in longobject.c) that "b" is used
after it has been freed:

 Done:
        Py_XDECREF(a);
        Py_XDECREF(b);
        Py_XDECREF(c);
        Py_XDECREF(temp);
        if (b->ob_size > FIVEARY_CUTOFF) {
                for (i = 0; i < 32; ++i)
                        Py_XDECREF(table[i]);
        }
        return (PyObject *)z;
}

The error exists in 2.4.1 and on CVS trunk.
msg25816 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2005-07-15 05:26 
Logged In: YES 
user_id=80475

Tim, I believe this one belongs to you (checkin 1.163 on
8/30/2004).
msg25817 - (view) Author: Tim Peters (tim.peters) * (Python committer) Date: 2005-07-17 23:47 
Logged In: YES 
user_id=31435

Eww -- gross.  Thanks for the report!  Repaired (along with a 
another long_pow() coding error) in:

Misc/NEWS 1.1319
Objects/longobject.c 1.169
msg25818 - (view) Author: Georg Brandl (georg.brandl) * (Python committer) Date: 2005-07-18 07:24 
Logged In: YES 
user_id=1188172

And backported as Objects/longobject.c r1.165.2.2.
History
Date User Action Args
2022-04-11 14:56:12adminsetgithub: 42190
2005-07-15 05:06:52lukedcreate