New submission from Alex CHEN: In file _elementtree.c
our static code scanner has reported this case, I think there is a bit similar to http://bugs.python.org/issue29874 (returns NULL when NoMemory) static PyObject* subelement(PyObject* self, PyObject* args, PyObject* kw) { PyObject* elem; ElementObject* parent; PyObject* tag; PyObject* attrib = NULL; if (!PyArg_ParseTuple(args, "O!O|O!:SubElement", &Element_Type, &parent, &tag, &PyDict_Type, &attrib)) return NULL; if (attrib || kw) { attrib = (attrib) ? PyDict_Copy(attrib) : PyDict_New(); if (!attrib) return NULL; if (kw) PyDict_Update(attrib, kw); } else { Py_INCREF(Py_None); attrib = Py_None; } elem = element_new(tag, attrib); // <== element_new could returns a NULL pointer, the followed Py_DECREF(elem) would dereference NULL pointer. Py_DECREF(attrib); if (element_add_subelement(parent, elem) < 0) { Py_DECREF(elem); return NULL; } ---------- components: XML messages: 289972 nosy: alexc priority: normal severity: normal status: open title: Check for null return value [_elementtree.c : subelement] type: crash versions: Python 2.7 _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue29876> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
