# HG changeset patch
# User ZyX <[email protected]>
# Date 1369465902 -14400
# Node ID f3a1f7c373ee941b71739260f72f6babbff6ce0f
# Parent  e3fac877d315709055ffaec4cc32a5f971ef5e97
Fix invalid read errors:

defer DICTKEY_UNREF until key is no longer needed

diff -r e3fac877d315 -r f3a1f7c373ee src/if_py_both.h
--- a/src/if_py_both.h  Fri May 24 23:11:02 2013 +0400
+++ b/src/if_py_both.h  Sat May 25 11:11:42 2013 +0400
@@ -1603,11 +1603,10 @@
     flags = get_option_value_strict(key, NULL, NULL,
                                    self->opt_type, self->from);
 
-    DICTKEY_UNREF
-
     if (flags == 0)
     {
        PyErr_SetObject(PyExc_KeyError, keyObject);
+       DICTKEY_UNREF
        return -1;
     }
 
@@ -1617,17 +1616,20 @@
        {
            PyErr_SetString(PyExc_ValueError,
                    _("unable to unset global option"));
+           DICTKEY_UNREF
            return -1;
        }
        else if (!(flags & SOPT_GLOBAL))
        {
            PyErr_SetString(PyExc_ValueError, _("unable to unset option "
                                                "without global value"));
+           DICTKEY_UNREF
            return -1;
        }
        else
        {
            unset_global_local_option(key, self->from);
+           DICTKEY_UNREF
            return 0;
        }
     }
@@ -1639,9 +1641,10 @@
        int     istrue = PyObject_IsTrue(valObject);
 
        if (istrue == -1)
-           return -1;
-       r = set_option_value_for(key, istrue, NULL,
-                               opt_flags, self->opt_type, self->from);
+           r = -1;
+       else
+           r = set_option_value_for(key, istrue, NULL,
+                                   opt_flags, self->opt_type, self->from);
     }
     else if (flags & SOPT_NUM)
     {
@@ -1657,6 +1660,7 @@
        else
        {
            PyErr_SetString(PyExc_TypeError, _("object must be integer"));
+           DICTKEY_UNREF
            return -1;
        }
 
@@ -1670,9 +1674,15 @@
        {
 
            if (PyString_AsStringAndSize(valObject, (char **) &val, NULL) == -1)
+           {
+               DICTKEY_UNREF
                return -1;
+           }
            if (val == NULL)
+           {
+               DICTKEY_UNREF
                return -1;
+           }
 
            val = vim_strsave(val);
        }
@@ -1682,12 +1692,21 @@
 
            bytes = PyUnicode_AsEncodedString(valObject, (char *)ENC_OPT, NULL);
            if (bytes == NULL)
+           {
+               DICTKEY_UNREF
                return -1;
+           }
 
            if(PyString_AsStringAndSize(bytes, (char **) &val, NULL) == -1)
+           {
+               DICTKEY_UNREF
                return -1;
+           }
            if (val == NULL)
+           {
+               DICTKEY_UNREF
                return -1;
+           }
 
            val = vim_strsave(val);
            Py_XDECREF(bytes);
@@ -1695,6 +1714,7 @@
        else
        {
            PyErr_SetString(PyExc_TypeError, _("object must be string"));
+           DICTKEY_UNREF
            return -1;
        }
 
@@ -1703,6 +1723,8 @@
        vim_free(val);
     }
 
+    DICTKEY_UNREF
+
     return r;
 }
 

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.


*** /tmp/extdiff.J8nVrD/vim.e3fac877d315/src/if_py_both.h	2013-05-25 12:47:20.605656887 +0400
--- vim.f3a1f7c373ee/src/if_py_both.h	2013-05-25 12:47:20.612653321 +0400
***************
*** 1603,1613 ****
      flags = get_option_value_strict(key, NULL, NULL,
  				    self->opt_type, self->from);
  
-     DICTKEY_UNREF
- 
      if (flags == 0)
      {
  	PyErr_SetObject(PyExc_KeyError, keyObject);
  	return -1;
      }
  
--- 1603,1612 ----
      flags = get_option_value_strict(key, NULL, NULL,
  				    self->opt_type, self->from);
  
      if (flags == 0)
      {
  	PyErr_SetObject(PyExc_KeyError, keyObject);
+ 	DICTKEY_UNREF
  	return -1;
      }
  
***************
*** 1617,1633 ****
--- 1616,1635 ----
  	{
  	    PyErr_SetString(PyExc_ValueError,
  		    _("unable to unset global option"));
+ 	    DICTKEY_UNREF
  	    return -1;
  	}
  	else if (!(flags & SOPT_GLOBAL))
  	{
  	    PyErr_SetString(PyExc_ValueError, _("unable to unset option "
  						"without global value"));
+ 	    DICTKEY_UNREF
  	    return -1;
  	}
  	else
  	{
  	    unset_global_local_option(key, self->from);
+ 	    DICTKEY_UNREF
  	    return 0;
  	}
      }
***************
*** 1639,1647 ****
  	int	istrue = PyObject_IsTrue(valObject);
  
  	if (istrue == -1)
! 	    return -1;
! 	r = set_option_value_for(key, istrue, NULL,
! 				opt_flags, self->opt_type, self->from);
      }
      else if (flags & SOPT_NUM)
      {
--- 1641,1650 ----
  	int	istrue = PyObject_IsTrue(valObject);
  
  	if (istrue == -1)
! 	    r = -1;
! 	else
! 	    r = set_option_value_for(key, istrue, NULL,
! 				    opt_flags, self->opt_type, self->from);
      }
      else if (flags & SOPT_NUM)
      {
***************
*** 1657,1662 ****
--- 1660,1666 ----
  	else
  	{
  	    PyErr_SetString(PyExc_TypeError, _("object must be integer"));
+ 	    DICTKEY_UNREF
  	    return -1;
  	}
  
***************
*** 1670,1678 ****
--- 1674,1688 ----
  	{
  
  	    if (PyString_AsStringAndSize(valObject, (char **) &val, NULL) == -1)
+ 	    {
+ 		DICTKEY_UNREF
  		return -1;
+ 	    }
  	    if (val == NULL)
+ 	    {
+ 		DICTKEY_UNREF
  		return -1;
+ 	    }
  
  	    val = vim_strsave(val);
  	}
***************
*** 1682,1693 ****
--- 1692,1712 ----
  
  	    bytes = PyUnicode_AsEncodedString(valObject, (char *)ENC_OPT, NULL);
  	    if (bytes == NULL)
+ 	    {
+ 		DICTKEY_UNREF
  		return -1;
+ 	    }
  
  	    if(PyString_AsStringAndSize(bytes, (char **) &val, NULL) == -1)
+ 	    {
+ 		DICTKEY_UNREF
  		return -1;
+ 	    }
  	    if (val == NULL)
+ 	    {
+ 		DICTKEY_UNREF
  		return -1;
+ 	    }
  
  	    val = vim_strsave(val);
  	    Py_XDECREF(bytes);
***************
*** 1695,1700 ****
--- 1714,1720 ----
  	else
  	{
  	    PyErr_SetString(PyExc_TypeError, _("object must be string"));
+ 	    DICTKEY_UNREF
  	    return -1;
  	}
  
***************
*** 1703,1708 ****
--- 1723,1730 ----
  	vim_free(val);
      }
  
+     DICTKEY_UNREF
+ 
      return r;
  }
  

Raspunde prin e-mail lui