Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita0a9928

Browse files
committed
Fix refcounting bug in PLy_modify_tuple().
We must increment the refcount on "plntup" as soon as we have thereference, not sometime later. Otherwise, if an error is thrown inbetween, the Py_XDECREF(plntup) call in the PG_CATCH block removes arefcount we didn't add, allowing the object to be freed even thoughit's still part of the plpython function's parsetree.This appears to be the cause of crashes seen on buildfarm memberprairiedog. It's a bit surprising that we've not seen it fail repeatablybefore, considering that the regression tests have been exercising thefaulty code path since 2009.The real-world impact is probably minimal, since it's unlikely anyone wouldbe provoking the "TD["new"] is not a dictionary" error in production, andthat's the only case that is actually wrong. Still, it's a bug affectingthe regression tests, so patch all supported branches.In passing, remove dead variable "plstr", and demote "platt" to a localvariable inside the PG_TRY block, since we don't need to clean it upin the PG_CATCH path.
1 parenta8603f0 commita0a9928

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

‎src/pl/plpython/plpython.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -769,9 +769,7 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
769769
{
770770
PyObject*volatileplntup;
771771
PyObject*volatileplkeys;
772-
PyObject*volatileplatt;
773772
PyObject*volatileplval;
774-
PyObject*volatileplstr;
775773
HeapTuplertup;
776774
intnatts,
777775
i,
@@ -787,7 +785,7 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
787785
plerrcontext.previous=error_context_stack;
788786
error_context_stack=&plerrcontext;
789787

790-
plntup=plkeys=platt=plval=plstr=NULL;
788+
plntup=plkeys=plval=NULL;
791789
modattrs=NULL;
792790
modvalues=NULL;
793791
modnulls=NULL;
@@ -797,10 +795,10 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
797795
if ((plntup=PyDict_GetItemString(pltd,"new"))==NULL)
798796
ereport(ERROR,
799797
(errmsg("TD[\"new\"] deleted, cannot modify row")));
798+
Py_INCREF(plntup);
800799
if (!PyDict_Check(plntup))
801800
ereport(ERROR,
802801
(errmsg("TD[\"new\"] is not a dictionary")));
803-
Py_INCREF(plntup);
804802

805803
plkeys=PyDict_Keys(plntup);
806804
natts=PyList_Size(plkeys);
@@ -813,6 +811,7 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
813811

814812
for (i=0;i<natts;i++)
815813
{
814+
PyObject*platt;
816815
char*plattstr;
817816

818817
platt=PyList_GetItem(plkeys,i);
@@ -879,7 +878,6 @@ PLy_modify_tuple(PLyProcedure *proc, PyObject *pltd, TriggerData *tdata,
879878
Py_XDECREF(plntup);
880879
Py_XDECREF(plkeys);
881880
Py_XDECREF(plval);
882-
Py_XDECREF(plstr);
883881

884882
if (modnulls)
885883
pfree(modnulls);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp