database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-04-29 13:56:47 +03:00
Code

Fix obscure segfault condition in PL/Python

Browse Source 
In PLy_output(), when the elog() call in the TRY branch throws an exception
(this can happen when a statement timeout kicks in, for example), the
PyErr_SetString() call in the CATCH branch can cause a segfault, because the
Py_XDECREF(so) call before it releases memory that is still used by the sv
variable that PyErr_SetString() uses as argument, because sv points into
memory owned by so.

Backpatched back to 8.0, where this code was introduced.

I also threw in a couple of volatile declarations for variables that are used
before and after the TRY.  I don't think they caused the crash that I
observed, but they could become issues.
This commit is contained in:
Peter Eisentraut 2009-11-03 08:12:46 +00:00
parent 3a2e457204
commit 1ef3f3cde3
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/pl/plpython/plpython.c
View File

@ -29,7 +29,7 @@
* MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/pl/plpython/plpython.c,v 1.66.2.6 2008/07/28 18:45:05 tgl Exp $
* $PostgreSQL: pgsql/src/pl/plpython/plpython.c,v 1.66.2.7 2009/11/03 08:12:46 petere Exp $
*
*********************************************************************
*/
@ -2410,9 +2410,9 @@ PLy_fatal(PyObject * self, PyObject * args)
static PyObject *
PLy_output(volatile int level, PyObject * self, PyObject * args)
{
PyObject *so;
PyObject *volatile so;
char *volatile sv;
MemoryContext oldcontext;
volatile MemoryContext oldcontext;
so = PyObject_Str(args);
if ((so == NULL) || ((sv = PyString_AsString(so)) == NULL))
@ -2431,6 +2431,10 @@ PLy_output(volatile int level, PyObject * self, PyObject * args)
MemoryContextSwitchTo(oldcontext);
PLy_error_in_progress = CopyErrorData();
FlushErrorState();
PyErr_SetString(PLy_exc_error, sv);
/* Note: If sv came from PyString_AsString(), it points into
* storage owned by so. So free so after using sv. */
Py_XDECREF(so);
/*
@ -2438,7 +2442,6 @@ PLy_output(volatile int level, PyObject * self, PyObject * args)
* control passes back to PLy_procedure_call, we check for PG
* exceptions and re-throw the error.
*/
PyErr_SetString(PLy_exc_error, sv);
return NULL;
}
PG_END_TRY();