# HG changeset patch
# Parent  f222508de71abda6927c868f3218c564c0076b51
Issue #28275: Clean up to avoid use-after-free after bzip decompress failure

diff -r f222508de71a Lib/test/test_bz2.py
--- a/Lib/test/test_bz2.py	Wed Sep 28 17:40:25 2016 -0400
+++ b/Lib/test/test_bz2.py	Thu Sep 29 01:47:19 2016 +0000
@@ -821,6 +821,12 @@
         out.append(bzd.decompress(self.DATA[300:]))
         self.assertEqual(b''.join(out), self.TEXT)
 
+    def test_failure(self):
+        bzd = BZ2Decompressor()
+        self.assertRaises(Exception, bzd.decompress, self.BAD_DATA * 30)
+        # Previously a second call could crash due to internal inconsistency
+        self.assertRaises(Exception, bzd.decompress, self.BAD_DATA * 30)
+
 class CompressDecompressTest(BaseTest):
     def testCompress(self):
         data = bz2.compress(self.TEXT)
diff -r f222508de71a Misc/NEWS
--- a/Misc/NEWS	Wed Sep 28 17:40:25 2016 -0400
+++ b/Misc/NEWS	Thu Sep 29 01:47:19 2016 +0000
@@ -64,7 +64,8 @@
   that they don't call itermonthdates() which can cause datetime.date
   under/overflow.
 
-- Issue #28275: Fixed possible use adter free in LZMADecompressor.decompress().
+- Issue #28275: Fixed possible use after free in the decompress()
+  methods of the LZMADecompressor and BZ2Decompressor classes.
   Original patch by John Leitch.
 
 - Issue #27897: Fixed possible crash in sqlite3.Connection.create_collation()
diff -r f222508de71a Modules/_bz2module.c
--- a/Modules/_bz2module.c	Wed Sep 28 17:40:25 2016 -0400
+++ b/Modules/_bz2module.c	Thu Sep 29 01:47:19 2016 +0000
@@ -534,8 +534,10 @@
     }
 
     result = decompress_buf(d, max_length);
-    if(result == NULL)
+    if(result == NULL) {
+        bzs->next_in = NULL;
         return NULL;
+    }
 
     if (d->eof) {
         d->needs_input = 0;