PL/Python: Fix potential NULL pointer dereference

petere · petere · commit e42e2f389076 · 2017-11-28T11:28:05.000-05:00
After d0aa965, one error path in PLy_spi_execute_fetch_result() could result in the variable "result" being dereferenced after being set to NULL. To fix that, just clear the resources right there and return early. Also add another SPI_freetuptable() call so that that is cleared in all error paths. discovered by John Naylor <jcnaylor@gmail.com> via scan-build
diff --git a/src/pl/plpython/plpy_spi.c b/src/pl/plpython/plpy_spi.c
@@ -361,7 +361,10 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status)
 
 	result = (PLyResultObject *) PLy_result_new();
 	if (!result)
+	{
+		SPI_freetuptable(tuptable);
 		return NULL;
+	}
 	Py_DECREF(result->status);
 	result->status = PyInt_FromLong(status);
 
@@ -414,7 +417,9 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status)
 				if (!result->rows)
 				{
 					Py_DECREF(result);
-					result = NULL;
+					MemoryContextDelete(cxt);
+					SPI_freetuptable(tuptable);
+					return NULL;
 				}
 				else
 				{

Original file line number	Diff line number	Diff line change
`@@ -361,7 +361,10 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status)`
`361`	`361`
`362`	`362`	`result = (PLyResultObject *) PLy_result_new();`
`363`	`363`	`if (!result)`
	`364`	`+ {`
	`365`	`+ SPI_freetuptable(tuptable);`
`364`	`366`	`return NULL;`
	`367`	`+ }`
`365`	`368`	`Py_DECREF(result->status);`
`366`	`369`	`result->status = PyInt_FromLong(status);`
`367`	`370`
`@@ -414,7 +417,9 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status)`
`414`	`417`	`if (!result->rows)`
`415`	`418`	`{`
`416`	`419`	`Py_DECREF(result);`
`417`		`- result = NULL;`
	`420`	`+ MemoryContextDelete(cxt);`
	`421`	`+ SPI_freetuptable(tuptable);`
	`422`	`+ return NULL;`
`418`	`423`	`}`
`419`	`424`	`else`
`420`	`425`	`{`