Repository navigation
Check tokens[0] after allocating memory #95355
Description
Bug report
I have questions when reading the source code of file pegen.c.
There is a code snippet in function _PyPegen_Parser_New:
p->tokens[0] = PyMem_Calloc(1, sizeof(Token));
if (!p->tokens) {
PyMem_Free(p->tokens);
PyMem_Free(p);
return (Parser *) PyErr_NoMemory();
}I think it makes more sense to check p->tokens[0] but not p->tokens in if condition.
I look at the PR #19669 where the code was introduced and no one discussed this. Is this an oversight, or am I wrong?
Your environment
- CPython versions tested on: main branch
Activity
pythongh-95355: Check tokens[0] after allocating memory
arhadthedev commentedon Jul 28, 2022
@AlexWaygood It seems to be a
type-crashsincePyMem_Calloc()failure is ignored leading to a C null pointer access somewhere below.AlexWaygood commentedon Jul 28, 2022
Sounds plausible, but I'm not much of a C programmer, so I'll let somebody else do the relabelling :)
pythongh-95355: Check tokens[0] after allocating memory (pythonGH-95356)
gh-95355: Check tokens[0] after allocating memory (GH-95356)
pythongh-95355: Check tokens[0] after allocating memory (pythonGH-95356)
gh-95355: Check tokens[0] after allocating memory (GH-95356)
gh-95355: Check tokens[0] after allocating memory (GH-95356)
kumaraditya303 commentedon Jul 28, 2022
Ok done, it can indeed segfault if allocation fails, classic null dereference :)
kumaraditya303 commentedon Jul 28, 2022
Fixed by #95356, thanks for the report!