diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2017-12-05 14:14:55 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2017-12-12 20:52:14 -0500 |
| commit | 4c6744ed705df6f388371d044b87d1b4a60e9f80 (patch) | |
| tree | b88bb007b6fab8af6192417d2099fe601f7484c2 | |
| parent | 85abb5b297c5b318738f09345ae226f780b88e92 (diff) | |
| download | postgresql-4c6744ed705df6f388371d044b87d1b4a60e9f80.tar.gz postgresql-4c6744ed705df6f388371d044b87d1b4a60e9f80.zip | |
PL/Python: Fix potential NULL pointer dereference
After d0aa965c0a0ac2ff7906ae1b1dad50a7952efa56, one error path in
PLy_spi_execute_fetch_result() could result in the variable "result"
being dereferenced after being set to NULL. Rearrange the code a bit to
fix that.
Also add another SPI_freetuptable() call so that that is cleared in all
error paths.
discovered by John Naylor <jcnaylor@gmail.com> via scan-build
ideas and review by Tom Lane
| -rw-r--r-- | src/pl/plpython/plpy_spi.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/src/pl/plpython/plpy_spi.c b/src/pl/plpython/plpy_spi.c index ade27f39242..0c623a94581 100644 --- a/src/pl/plpython/plpy_spi.c +++ b/src/pl/plpython/plpy_spi.c @@ -361,7 +361,10 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status) result = (PLyResultObject *) PLy_result_new(); if (!result) + { + SPI_freetuptable(tuptable); return NULL; + } Py_DECREF(result->status); result->status = PyInt_FromLong(status); @@ -411,12 +414,7 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status) Py_DECREF(result->rows); result->rows = PyList_New(rows); - if (!result->rows) - { - Py_DECREF(result); - result = NULL; - } - else + if (result->rows) { PLy_input_setup_tuple(&ininfo, tuptable->tupdesc, exec_ctx->curr_proc); @@ -455,6 +453,13 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status) MemoryContextDelete(cxt); SPI_freetuptable(tuptable); + + /* in case PyList_New() failed above */ + if (!result->rows) + { + Py_DECREF(result); + result = NULL; + } } return (PyObject *) result; |