# HG changeset patch # User Yuya Nishihara # Date 1536151784 -32400 # Node ID 094d1f42c484bb43b68e073bd49897a31c48b978 # Parent ca77788c81bc449a6ebd47f80d1a50a3813002b4 manifest: fix leak on error return from lazymanifest_filtercopy() Spotted by ASAN. free(copy->lines) and Py_DECREF(copy->pydata) are replaced by Py_XDECREF(copy), which should call lazymanifest_dealloc(). Freeing half-initialized copy->lines is safe since copy->numlines holds a valid value. diff -r ca77788c81bc -r 094d1f42c484 mercurial/cext/manifest.c --- a/mercurial/cext/manifest.c Wed Sep 05 21:46:53 2018 +0900 +++ b/mercurial/cext/manifest.c Wed Sep 05 21:49:44 2018 +0900 @@ -731,16 +731,14 @@ arglist = Py_BuildValue(PY23("(s)", "(y)"), self->lines[i].start); if (!arglist) { - return NULL; + goto bail; } result = PyObject_CallObject(matchfn, arglist); Py_DECREF(arglist); /* if the callback raised an exception, just let it * through and give up */ if (!result) { - free(copy->lines); - Py_DECREF(copy->pydata); - return NULL; + goto bail; } if (PyObject_IsTrue(result)) { assert(!(self->lines[i].from_malloc)); @@ -752,6 +750,7 @@ return copy; nomem: PyErr_NoMemory(); +bail: Py_XDECREF(copy); return NULL; }