Issues/88027: A potential double free in list_sort_impl (#92367)

tim-one · web-flow · commit 9652900969df · 2022-05-05T23:14:09.000-05:00
merge_freemem(): set keys to NULL do it's harmless to call this again.
diff --git a/Objects/listobject.c b/Objects/listobject.c
@@ -1573,8 +1573,10 @@ static void
 merge_freemem(MergeState *ms)
 {
     assert(ms != NULL);
-    if (ms->a.keys != ms->temparray)
+    if (ms->a.keys != ms->temparray) {
         PyMem_Free(ms->a.keys);
+        ms->a.keys = NULL;
+    }
 }
 
 /* Ensure enough temp memory for 'need' array slots is available.

Original file line number	Diff line number	Diff line change
`@@ -1573,8 +1573,10 @@ static void`
`1573`	`1573`	`merge_freemem(MergeState *ms)`
`1574`	`1574`	`{`
`1575`	`1575`	`assert(ms != NULL);`
`1576`		`- if (ms->a.keys != ms->temparray)`
	`1576`	`+ if (ms->a.keys != ms->temparray) {`
`1577`	`1577`	`PyMem_Free(ms->a.keys);`
	`1578`	`+ ms->a.keys = NULL;`
	`1579`	`+ }`
`1578`	`1580`	`}`
`1579`	`1581`
`1580`	`1582`	`/* Ensure enough temp memory for 'need' array slots is available.`