fix for a handful of memory leaks relating to parsing and allocating arbitrary sized vectors from python args.

Vector.dot() was always leaking memory, and would crash if args sizes didnt match.

These errors were introduced with n-dimensional vector support.

also fixed an error with bmesh py api allocation.

2 files changed, 22 insertions, 26 deletions

diff --git a/source/blender/python/mathutils/mathutils.c b/source/blender/python/mathutils/mathutils.c
index 8b79301f264..c08165f9850 100644
--- a/source/blender/python/mathutils/mathutils.c
+++ b/source/blender/python/mathutils/mathutils.c
@@ -133,6 +133,7 @@ int mathutils_array_parse(float *array, int array_min, int array_max, PyObject *
 	}
 }
 
+/* on error, -1 is returned and no allocation is made */
 int mathutils_array_parse_alloc(float **array, int array_min, PyObject *value, const char *error_prefix)
 {
 	int size;
@@ -164,6 +165,7 @@ int mathutils_array_parse_alloc(float **array, int array_min, PyObject *value, c
 	{
 		PyObject *value_fast = NULL;
 		// *array = NULL;
+		int ret;
 
 		/* non list/tuple cases */
 		if (!(value_fast = PySequence_Fast(value, error_prefix))) {
@@ -182,7 +184,13 @@ int mathutils_array_parse_alloc(float **array, int array_min, PyObject *value, c
 
 		*array = PyMem_Malloc(size * sizeof(float));
 
-		return mathutils_array_parse_fast(*array, size, value_fast, error_prefix);
+		ret = mathutils_array_parse_fast(*array, size, value_fast, error_prefix);
+
+		if (ret == -1) {
+			PyMem_Free(*array);
+		}
+
+		return ret;
 	}
 }
 
diff --git a/source/blender/python/mathutils/mathutils_Vector.c b/source/blender/python/mathutils/mathutils_Vector.c
index 8c316807660..79285b7778d 100644
--- a/source/blender/python/mathutils/mathutils_Vector.c
+++ b/source/blender/python/mathutils/mathutils_Vector.c
@@ -81,9 +81,6 @@ static PyObject *Vector_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 			break;
 		case 1:
 			if ((size = mathutils_array_parse_alloc(&vec, 2, PyTuple_GET_ITEM(args, 0), "mathutils.Vector()")) == -1) {
-				if (vec) {
-					PyMem_Free(vec);
-				}
 				return NULL;
 			}
 			break;
@@ -93,7 +90,7 @@ static PyObject *Vector_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 			                "more then a single arg given");
 			return NULL;
 	}
-	return Vector_CreatePyObject(vec, size, Py_NEW, type);
+	return Vector_CreatePyObject_alloc(vec, size, type);
 }
 
 static PyObject *vec__apply_to_copy(PyNoArgsFunction vec_func, VectorObject *self)
@@ -301,7 +298,6 @@ static PyObject *C_Vector_Repeat(PyObject *cls, PyObject *args)
 	if ((value_size = mathutils_array_parse_alloc(&iter_vec, 2, value,
 	                                              "Vector.Repeat(vector, size), invalid 'vector' arg")) == -1)
 	{
-		PyMem_Free(iter_vec);
 		return NULL;
 	}
 
@@ -315,6 +311,7 @@ static PyObject *C_Vector_Repeat(PyObject *cls, PyObject *args)
 	vec = PyMem_Malloc(size * sizeof(float));
 
 	if (vec == NULL) {
+		PyMem_Free(iter_vec);
 		PyErr_SetString(PyExc_MemoryError,
 		                "Vector.Repeat(): "
 		                "problem allocating pointer space");
@@ -898,19 +895,18 @@ PyDoc_STRVAR(Vector_dot_doc,
 static PyObject *Vector_dot(VectorObject *self, PyObject *value)
 {
 	float *tvec;
+	PyObject *ret;
 
 	if (BaseMath_ReadCallback(self) == -1)
 		return NULL;
 
 	if (mathutils_array_parse_alloc(&tvec, self->size, value, "Vector.dot(other), invalid 'other' arg") == -1) {
-		goto cleanup;
+		return NULL;
 	}
 
-	return PyFloat_FromDouble(dot_vn_vn(self->vec, tvec, self->size));
-
-cleanup:
+	ret = PyFloat_FromDouble(dot_vn_vn(self->vec, tvec, self->size));
 	PyMem_Free(tvec);
-	return NULL;
+	return ret;
 }
 
 PyDoc_STRVAR(Vector_angle_doc,
@@ -1140,12 +1136,12 @@ static PyObject *Vector_lerp(VectorObject *self, PyObject *args)
 	if (!PyArg_ParseTuple(args, "Of:lerp", &value, &fac))
 		return NULL;
 
-	if (mathutils_array_parse_alloc(&tvec, size, value, "Vector.lerp(other), invalid 'other' arg") == -1) {
-		goto cleanup;
+	if (BaseMath_ReadCallback(self) == -1) {
+		return NULL;
 	}
 
-	if (BaseMath_ReadCallback(self) == -1) {
-		goto cleanup;
+	if (mathutils_array_parse_alloc(&tvec, size, value, "Vector.lerp(other), invalid 'other' arg") == -1) {
+		return NULL;
 	}
 
 	vec = PyMem_Malloc(size * sizeof(float));
@@ -1165,10 +1161,6 @@ static PyObject *Vector_lerp(VectorObject *self, PyObject *args)
 	PyMem_Free(tvec);
 
 	return Vector_CreatePyObject_alloc(vec, size, Py_TYPE(self));
-
-cleanup:
-	PyMem_Free(tvec);
-	return NULL;
 }
 
 PyDoc_STRVAR(Vector_rotate_doc,
@@ -1370,7 +1362,7 @@ static int Vector_ass_slice(VectorObject *self, int begin, int end, PyObject *se
 
 	size = (end - begin);
 	if (mathutils_array_parse_alloc(&vec, size, seq, "vector[begin:end] = [...]") == -1) {
-		goto cleanup;
+		return -1;
 	}
 
 	if (vec == NULL) {
@@ -1383,16 +1375,12 @@ static int Vector_ass_slice(VectorObject *self, int begin, int end, PyObject *se
 	/*parsed well - now set in vector*/
 	memcpy(self->vec + begin, vec, size * sizeof(float));
 
+	PyMem_Free(vec);
+
 	if (BaseMath_WriteCallback(self) == -1)
 		return -1;
 
-	PyMem_Free(vec);
-
 	return 0;
-
-cleanup:
-	PyMem_Free(vec);
-	return -1;
 }
 
 /* Numeric Protocols */