Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2d5e0f0

Browse files
committed
Fix refcounting bug in PLy_modify_tuple().
We must increment the refcount on "plntup" as soon as we have thereference, not sometime later. Otherwise, if an error is thrown inbetween, the Py_XDECREF(plntup) call in the PG_CATCH block removes arefcount we didn't add, allowing the object to be freed even thoughit's still part of the plpython function's parsetree.This appears to be the cause of crashes seen on buildfarm memberprairiedog. It's a bit surprising that we've not seen it fail repeatablybefore, considering that the regression tests have been exercising thefaulty code path since 2009.The real-world impact is probably minimal, since it's unlikely anyone wouldbe provoking the "TD["new"] is not a dictionary" error in production, andthat's the only case that is actually wrong. Still, it's a bug affectingthe regression tests, so patch all supported branches.In passing, remove dead variable "plstr", and demote "platt" to a localvariable inside the PG_TRY block, since we don't need to clean it upin the PG_CATCH path.
1 parentc2a6724 commit2d5e0f0

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

‎src/pl/plpython/plpy_exec.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -635,9 +635,7 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
635635
{
636636
PyObject*volatileplntup;
637637
PyObject*volatileplkeys;
638-
PyObject*volatileplatt;
639638
PyObject*volatileplval;
640-
PyObject*volatileplstr;
641639
HeapTuplertup;
642640
intnatts,
643641
i,
@@ -653,7 +651,7 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
653651
plerrcontext.previous=error_context_stack;
654652
error_context_stack=&plerrcontext;
655653

656-
plntup=plkeys=platt=plval=plstr=NULL;
654+
plntup=plkeys=plval=NULL;
657655
modattrs=NULL;
658656
modvalues=NULL;
659657
modnulls=NULL;
@@ -663,10 +661,10 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
663661
if ((plntup=PyDict_GetItemString(pltd,"new"))==NULL)
664662
ereport(ERROR,
665663
(errmsg("TD[\"new\"] deleted, cannot modify row")));
664+
Py_INCREF(plntup);
666665
if (!PyDict_Check(plntup))
667666
ereport(ERROR,
668667
(errmsg("TD[\"new\"] is not a dictionary")));
669-
Py_INCREF(plntup);
670668

671669
plkeys=PyDict_Keys(plntup);
672670
natts=PyList_Size(plkeys);
@@ -679,6 +677,7 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
679677

680678
for (i=0;i<natts;i++)
681679
{
680+
PyObject*platt;
682681
char*plattstr;
683682

684683
platt=PyList_GetItem(plkeys,i);
@@ -745,7 +744,6 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
745744
Py_XDECREF(plntup);
746745
Py_XDECREF(plkeys);
747746
Py_XDECREF(plval);
748-
Py_XDECREF(plstr);
749747

750748
if (modnulls)
751749
pfree(modnulls);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp