changeset:   103701:3a6917c73857
user:        Victor Stinner <victor.stinner@gmail.com>
date:        Mon Sep 12 11:41:58 2016 +0200
files:       Modules/socketmodule.c
description:
socket: Fix memory leak in sendmsg() and sendmsg_afalg()

Issue #27744:

* Release msg.msg_iov memory block.
* Release memory on PyMem_Malloc(controllen) failure


diff -r a951f8f30922 -r 3a6917c73857 Modules/socketmodule.c
--- a/Modules/socketmodule.c	Mon Sep 12 11:45:59 2016 +0200
+++ b/Modules/socketmodule.c	Mon Sep 12 11:41:58 2016 +0200
@@ -4072,11 +4072,13 @@
     if (ncmsgbufs > 0) {
         struct cmsghdr *cmsgh = NULL;
 
-        if ((msg.msg_control = controlbuf =
-             PyMem_Malloc(controllen)) == NULL) {
+        controlbuf = PyMem_Malloc(controllen);
+        if (controlbuf == NULL) {
             PyErr_NoMemory();
             goto finally;
         }
+        msg.msg_control = controlbuf;
+
         msg.msg_controllen = controllen;
 
         /* Need to zero out the buffer as a workaround for glibc's
@@ -4141,8 +4143,10 @@
         PyBuffer_Release(&cmsgs[i].data);
     PyMem_Free(cmsgs);
     Py_XDECREF(cmsg_fast);
-    for (i = 0; i < ndatabufs; i++)
+    PyMem_Free(msg.msg_iov);
+    for (i = 0; i < ndatabufs; i++) {
         PyBuffer_Release(&databufs[i]);
+    }
     PyMem_Free(databufs);
     return retval;
 }
@@ -4243,7 +4247,8 @@
 
     controlbuf = PyMem_Malloc(controllen);
     if (controlbuf == NULL) {
-        return PyErr_NoMemory();
+        PyErr_NoMemory();
+        goto finally;
     }
     memset(controlbuf, 0, controllen);
 
@@ -4315,8 +4320,10 @@
     if (iv.buf != NULL) {
         PyBuffer_Release(&iv);
     }
-    for (i = 0; i < ndatabufs; i++)
+    PyMem_Free(msg.msg_iov);
+    for (i = 0; i < ndatabufs; i++) {
         PyBuffer_Release(&databufs[i]);
+    }
     PyMem_Free(databufs);
     return retval;
 }