Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the

tstate is first removed from TLS and then deallocated.
CID 1019639 (#1 of 1): Use after free (USE_AFTER_FREE)
 use_after_free: Using freed pointer tstate.

1 files changed, 15 insertions, 11 deletions

diff --git a/Python/future.c b/Python/future.c
index d24ae416ff..80978147f5 100644
--- a/Python/future.c
+++ b/Python/future.c
@@ -58,11 +58,15 @@ future_check_features(PyFutureFeatures *ff, stmt_ty s, const char *filename)
 static int
 future_parse(PyFutureFeatures *ff, mod_ty mod, const char *filename)
 {
-    int i, found_docstring = 0, done = 0, prev_line = 0;
+    int i, done = 0, prev_line = 0;
+    stmt_ty first;
 
     if (!(mod->kind == Module_kind || mod->kind == Interactive_kind))
         return 1;
 
+    if (asdl_seq_LEN(mod->v.Module.body) == 0)
+        return 1;
+
     /* A subsequent pass will detect future imports that don't
        appear at the beginning of the file.  There's one case,
        however, that is easier to handle here: A series of imports
@@ -71,8 +75,13 @@ future_parse(PyFutureFeatures *ff, mod_ty mod, const char *filename)
        but is preceded by a regular import.
     */
 
+    i = 0;
+    first = (stmt_ty)asdl_seq_GET(mod->v.Module.body, i);
+    if (first->kind == Expr_kind && first->v.Expr.value->kind == Str_kind)
+        i++;
 
-    for (i = 0; i < asdl_seq_LEN(mod->v.Module.body); i++) {
+
+    for (; i < asdl_seq_LEN(mod->v.Module.body); i++) {
         stmt_ty s = (stmt_ty)asdl_seq_GET(mod->v.Module.body, i);
 
         if (done && s->lineno > prev_line)
@@ -99,18 +108,13 @@ future_parse(PyFutureFeatures *ff, mod_ty mod, const char *filename)
                     return 0;
                 ff->ff_lineno = s->lineno;
             }
-            else
+            else {
                 done = 1;
+            }
         }
-        else if (s->kind == Expr_kind && !found_docstring) {
-            expr_ty e = s->v.Expr.value;
-            if (e->kind != Str_kind)
-                done = 1;
-            else
-                found_docstring = 1;
-        }
-        else
+        else {
             done = 1;
+        }
     }
     return 1;
 }