Issues/88027: A potential double free in list_sort_impl (GH-92367)

miss-islington · tim-one · web-flow · commit 0eef443f0142 · 2022-05-05T21:38:14.000-07:00
merge_freemem(): set keys to NULL do it's harmless to call this again. (cherry picked from commit 9652900) Co-authored-by: Tim Peters <tim.peters@gmail.com>
diff --git a/Objects/listobject.c b/Objects/listobject.c
@@ -1548,8 +1548,10 @@ static void
 merge_freemem(MergeState *ms)
 {
     assert(ms != NULL);
-    if (ms->a.keys != ms->temparray)
+    if (ms->a.keys != ms->temparray) {
         PyMem_Free(ms->a.keys);
+        ms->a.keys = NULL;
+    }
 }
 
 /* Ensure enough temp memory for 'need' array slots is available.

Original file line number	Diff line number	Diff line change
`@@ -1548,8 +1548,10 @@ static void`
`1548`	`1548`	`merge_freemem(MergeState *ms)`
`1549`	`1549`	`{`
`1550`	`1550`	`assert(ms != NULL);`
`1551`		`- if (ms->a.keys != ms->temparray)`
	`1551`	`+ if (ms->a.keys != ms->temparray) {`
`1552`	`1552`	`PyMem_Free(ms->a.keys);`
	`1553`	`+ ms->a.keys = NULL;`
	`1554`	`+ }`
`1553`	`1555`	`}`
`1554`	`1556`
`1555`	`1557`	`/* Ensure enough temp memory for 'need' array slots is available.`