This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Title: Check for null return value [_elementtree.c : subelement]
Type: crash Stage: resolved
Components: XML Versions: Python 2.7
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: alexc, xiang.zhang
Priority: normal Keywords:

Created on 2017-03-22 05:52 by alexc, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 760 merged xiang.zhang, 2017-03-22 06:17
Messages (2)
msg289972 - (view) Author: Alex CHEN (alexc) Date: 2017-03-22 05:52
In file _elementtree.c

our static code scanner has reported this case, I think there is a bit similar to (returns NULL when NoMemory)

static PyObject*
subelement(PyObject* self, PyObject* args, PyObject* kw)
    PyObject* elem;

    ElementObject* parent;
    PyObject* tag;
    PyObject* attrib = NULL;
    if (!PyArg_ParseTuple(args, "O!O|O!:SubElement",
                          &Element_Type, &parent, &tag,
                          &PyDict_Type, &attrib))
        return NULL;

    if (attrib || kw) {
        attrib = (attrib) ? PyDict_Copy(attrib) : PyDict_New();
        if (!attrib)
            return NULL;
        if (kw)
            PyDict_Update(attrib, kw);
    } else {
        attrib = Py_None;

    elem = element_new(tag, attrib);              // <== element_new could returns a NULL pointer, the followed Py_DECREF(elem) would dereference NULL pointer.


    if (element_add_subelement(parent, elem) < 0) {
        return NULL;
msg290114 - (view) Author: Xiang Zhang (xiang.zhang) * (Python committer) Date: 2017-03-24 20:08
New changeset 9c0408d9b68d8f65aad22ca0767f154d6b9f526c by Xiang Zhang in branch '2.7':
bpo-29876: fix DECREF for NULL value in subelement() (GH-760)
Date User Action Args
2022-04-11 14:58:44adminsetgithub: 74062
2017-03-24 20:08:33xiang.zhangsetnosy: + xiang.zhang
messages: + msg290114
2017-03-22 06:33:08xiang.zhangsetstatus: open -> closed
resolution: fixed
stage: resolved
2017-03-22 06:17:09xiang.zhangsetpull_requests: + pull_request673
2017-03-22 05:52:24alexccreate