From 42829407289f85a9151de033bf77ba92ad865c1a Mon Sep 17 00:00:00 2001 From: Yu Feng Date: Wed, 19 Oct 2016 12:03:30 -0700 Subject: [PATCH] BUG: protect stolen ref by NewFromDescr in array_empty fixes #8179 --- numpy/core/src/multiarray/ctors.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/numpy/core/src/multiarray/ctors.c b/numpy/core/src/multiarray/ctors.c index b2ef0c451c01..d32b1c937f6b 100644 --- a/numpy/core/src/multiarray/ctors.c +++ b/numpy/core/src/multiarray/ctors.c @@ -2895,20 +2895,27 @@ PyArray_Empty(int nd, npy_intp *dims, PyArray_Descr *type, int is_f_order) PyArrayObject *ret; if (!type) type = PyArray_DescrFromType(NPY_DEFAULT_TYPE); + + /* + * PyArray_NewFromDescr steals a ref, + * but we need to look at type later. + * */ + Py_INCREF(type); + ret = (PyArrayObject *)PyArray_NewFromDescr(&PyArray_Type, type, nd, dims, NULL, NULL, is_f_order, NULL); - if (ret == NULL) { - return NULL; - } - if (PyDataType_REFCHK(type)) { + if (ret != NULL && PyDataType_REFCHK(type)) { PyArray_FillObjectArray(ret, Py_None); if (PyErr_Occurred()) { Py_DECREF(ret); + Py_DECREF(type); return NULL; } } + + Py_DECREF(type); return (PyObject *)ret; }