(f)utility

7th April 2010

Text

Crash on object deletion in pyao and pyogg

The author of pyogg goofed up on python object deletion in the wrapper. This was reported.

Unfortunately libao (0.82) is also affected, and there’s no action even on the previous pyogg bug. It causes a “glibc double-free” on Linux and a “pointer being freed was not allocated” on Mac OS X.

The project seems quite dead, but is merely a wrapper to the C libs where the real action takes place, so there’s not much of a fuss to have it unmaintained.

Here is the patch against pyao:

--- src/aomodule.c.orig 2010-04-07 19:06:45.000000000 +0200
+++ src/aomodule.c  2010-04-07 19:06:56.000000000 +0200
@@ -150,7 +150,7 @@
 py_ao_dealloc(ao_Object *self)
 {
   ao_close(self->dev);
-  PyMem_DEL(self);
+  PyObject_DEL(self);
 }

 static PyObject *

And for reference, the patch against pyogg:

Index: legacy/pyvorbis/pyvorbisfile.c
===================================================================
--- legacy/pyvorbis/pyvorbisfile.c  (revision 20)
+++ legacy/pyvorbis/pyvorbisfile.c  (working copy)
@@ -173,8 +173,7 @@
   if (ret == NULL) {
     PyMem_DEL(newobj);
     return NULL;
-  } else
-    Py_DECREF(ret);
+  }

   return (PyObject *) newobj;
 }
@@ -191,11 +190,13 @@
        close */
     Py_DECREF(py_self->py_file);
   } else {
-    /* Otherwise, we opened the file and should close it. */
-    fclose(py_self->c_file);
+    /* Do NOT close the file -- ov_open() takes ownership of the FILE*,
+       and ov_close() is responsible for closing it. */
   }

-  PyMem_DEL(self);
+  free(py_self->ovf);
+
+  PyObject_DEL(self);
 }

 static PyObject *