1 files changed, 18 insertions, 9 deletions

diff --git a/Modules/cPickle.c b/Modules/cPickle.c
index 0d293627af..24c98ccb22 100644
--- a/Modules/cPickle.c
+++ b/Modules/cPickle.c
@@ -196,7 +196,7 @@ Pdata_clear(Pdata *self, int clearto)
 	for (i = self->length, p = self->data + clearto;
 	     --i >= clearto;
 	     p++) {
-		Py_DECREF(*p);
+		Py_CLEAR(*p);
 	}
 	self->length = clearto;
 
@@ -208,6 +208,7 @@ Pdata_grow(Pdata *self)
 {
 	int bigger;
 	size_t nbytes;
+	PyObject **tmp;
 
 	bigger = self->size << 1;
 	if (bigger <= 0)	/* was 0, or new value overflows */
@@ -217,14 +218,14 @@ Pdata_grow(Pdata *self)
 	nbytes = (size_t)bigger * sizeof(PyObject *);
 	if (nbytes / sizeof(PyObject *) != (size_t)bigger)
 		goto nomemory;
-	self->data = realloc(self->data, nbytes);
-	if (self->data == NULL)
+	tmp = realloc(self->data, nbytes);
+	if (tmp == NULL)
 		goto nomemory;
+	self->data = tmp;
 	self->size = bigger;
 	return 0;
 
   nomemory:
-	self->size = 0;
 	PyErr_NoMemory();
 	return -1;
 }
@@ -2636,7 +2637,7 @@ Pickle_getvalue(Picklerobject *self, PyObject *args)
 			if (ik >= lm || ik == 0) {
 				PyErr_SetString(PicklingError,
 						"Invalid get data");
-				return NULL;
+				goto err;
 			}
 			if (have_get[ik]) /* with matching get */
 				rsize += ik < 256 ? 2 : 5;
@@ -2648,7 +2649,7 @@ Pickle_getvalue(Picklerobject *self, PyObject *args)
 			) {
 			PyErr_SetString(PicklingError,
 					"Unexpected data in internal list");
-			return NULL;
+			goto err;
 		}
 
 		else { /* put */
@@ -3400,11 +3401,11 @@ load_string(Unpicklerobject *self)
 	/********************************************/
 
 	str = PyString_DecodeEscape(p, len, NULL, 0, NULL);
+	free(s);
 	if (str) {
 		PDATA_PUSH(self->stack, str, -1);
 		res = 0;
 	}
-	free(s);
 	return res;
 
   insecure:
@@ -3628,10 +3629,14 @@ Instance_New(PyObject *cls, PyObject *args)
 
   err:
 	{
-		PyObject *tp, *v, *tb;
+		PyObject *tp, *v, *tb, *tmp_value;
 
 		PyErr_Fetch(&tp, &v, &tb);
-		if ((r=PyTuple_Pack(3,v,cls,args))) {
+		tmp_value = v;
+		/* NULL occurs when there was a KeyboardInterrupt */
+		if (tmp_value == NULL)
+			tmp_value = Py_None;
+		if ((r = PyTuple_Pack(3, tmp_value, cls, args))) {
 			Py_XDECREF(v);
 			v=r;
 		}
@@ -4159,6 +4164,7 @@ do_append(Unpicklerobject *self, int  x)
 		int list_len;
 
 		slice=Pdata_popList(self->stack, x);
+		if (! slice) return -1;
 		list_len = PyList_GET_SIZE(list);
 		i=PyList_SetSlice(list, list_len, list_len, slice);
 		Py_DECREF(slice);
@@ -5163,6 +5169,9 @@ newUnpicklerobject(PyObject *f)
 	if (!( self->memo = PyDict_New()))
 		goto err;
 
+	if (!self->stack)
+		goto err;
+
 	Py_INCREF(f);
 	self->file = f;