Avoid Python memory leaks in hstore_plpython and jsonb_plpython.

tglsfdc · tglsfdc · commit 9e360f0e8327 · 2019-04-06T17:54:29.000-04:00
Fix some places where we might fail to do Py_DECREF() on a Python object (thereby leaking it for the rest of the session). Almost all of the risks were in error-recovery paths, which we don't really expect to hit anyway. Hence, while this is definitely a bug fix, it doesn't quite seem worth back-patching. Nikita Glukhov, Michael Paquier, Tom Lane Discussion: https://postgr.es/m/28053a7d-10d8-fc23-b05c-b4749c873f63@postgrespro.ru
diff --git a/contrib/hstore_plpython/hstore_plpython.c b/contrib/hstore_plpython/hstore_plpython.c
@@ -128,9 +128,9 @@ Datum
 plpython_to_hstore(PG_FUNCTION_ARGS)
 {
 	PyObject   *dict;
-	PyObject *volatile items = NULL;
-	int32		pcount;
-	HStore	   *out;
+	PyObject   *volatile items;
+	Py_ssize_t	pcount;
+	HStore	   *volatile out;
 
 	dict = (PyObject *) PG_GETARG_POINTER(0);
 	if (!PyMapping_Check(dict))
@@ -144,7 +144,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
 	PG_TRY();
 	{
 		int32		buflen;
-		int32		i;
+		Py_ssize_t	i;
 		Pairs	   *pairs;
 
 		pairs = palloc(pcount * sizeof(*pairs));
@@ -176,7 +176,6 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
 				pairs[i].isnull = false;
 			}
 		}
-		Py_DECREF(items);
 
 		pcount = hstoreUniquePairs(pairs, pcount, &buflen);
 		out = hstorePairs(pairs, pcount, buflen);
@@ -188,5 +187,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
 	}
 	PG_END_TRY();
 
+	Py_DECREF(items);
+
 	PG_RETURN_POINTER(out);
 }
diff --git a/contrib/jsonb_plpython/jsonb_plpython.c b/contrib/jsonb_plpython/jsonb_plpython.c
@@ -164,56 +164,91 @@ PLyObject_FromJsonbContainer(JsonbContainer *jsonb)
 			}
 			else
 			{
-				/* array in v */
+				PyObject   *volatile elem = NULL;
+
 				result = PyList_New(0);
 				if (!result)
 					return NULL;
 
-				while ((r = JsonbIteratorNext(&it, &v, true)) != WJB_DONE)
+				PG_TRY();
 				{
-					if (r == WJB_ELEM)
+					while ((r = JsonbIteratorNext(&it, &v, true)) != WJB_DONE)
 					{
-						PyObject   *elem = PLyObject_FromJsonbValue(&v);
+						if (r != WJB_ELEM)
+							continue;
+
+						elem = PLyObject_FromJsonbValue(&v);
 
 						PyList_Append(result, elem);
 						Py_XDECREF(elem);
+						elem = NULL;
 					}
 				}
+				PG_CATCH();
+				{
+					Py_XDECREF(elem);
+					Py_XDECREF(result);
+					PG_RE_THROW();
+				}
+				PG_END_TRY();
 			}
 			break;
 
 		case WJB_BEGIN_OBJECT:
-			result = PyDict_New();
-			if (!result)
-				return NULL;
-
-			while ((r = JsonbIteratorNext(&it, &v, true)) != WJB_DONE)
 			{
-				if (r == WJB_KEY)
-				{
-					PyObject   *key = PLyString_FromJsonbValue(&v);
+				PyObject   *volatile result_v = PyDict_New();
+				PyObject   *volatile key = NULL;
+				PyObject   *volatile val = NULL;
 
-					if (!key)
-						return NULL;
-
-					r = JsonbIteratorNext(&it, &v, true);
+				if (!result_v)
+					return NULL;
 
-					if (r == WJB_VALUE)
+				PG_TRY();
+				{
+					while ((r = JsonbIteratorNext(&it, &v, true)) != WJB_DONE)
 					{
-						PyObject   *value = PLyObject_FromJsonbValue(&v);
+						if (r != WJB_KEY)
+							continue;
 
-						if (!value)
+						key = PLyString_FromJsonbValue(&v);
+						if (!key)
+						{
+							Py_XDECREF(result_v);
+							result_v = NULL;
+							break;
+						}
+
+						if ((r = JsonbIteratorNext(&it, &v, true)) != WJB_VALUE)
+							elog(ERROR, "unexpected jsonb token: %d", r);
+
+						val = PLyObject_FromJsonbValue(&v);
+						if (!val)
 						{
 							Py_XDECREF(key);
-							return NULL;
+							key = NULL;
+							Py_XDECREF(result_v);
+							result_v = NULL;
+							break;
 						}
 
-						PyDict_SetItem(result, key, value);
-						Py_XDECREF(value);
-					}
+						PyDict_SetItem(result_v, key, val);
 
+						Py_XDECREF(key);
+						key = NULL;
+						Py_XDECREF(val);
+						val = NULL;
+					}
+				}
+				PG_CATCH();
+				{
+					Py_XDECREF(result_v);
 					Py_XDECREF(key);
+					Py_XDECREF(val);
+					PG_RE_THROW();
 				}
+				PG_END_TRY();
+
+				result = result_v;
 			}
 			break;
 
@@ -234,10 +269,8 @@ static JsonbValue *
 PLyMapping_ToJsonbValue(PyObject *obj, JsonbParseState **jsonb_state)
 {
 	Py_ssize_t	pcount;
-	JsonbValue *out = NULL;
-
-	/* We need it volatile, since we use it after longjmp */
-	PyObject *volatile items = NULL;
+	PyObject   *volatile items;
+	JsonbValue *volatile out;
 
 	pcount = PyMapping_Size(obj);
 	items = PyMapping_Items(obj);
@@ -281,6 +314,8 @@ PLyMapping_ToJsonbValue(PyObject *obj, JsonbParseState **jsonb_state)
 	}
 	PG_END_TRY();
 
+	Py_DECREF(items);
+
 	return out;
 }
 
@@ -295,19 +330,30 @@ PLySequence_ToJsonbValue(PyObject *obj, JsonbParseState **jsonb_state)
 {
 	Py_ssize_t	i;
 	Py_ssize_t	pcount;
+	PyObject   *volatile value = NULL;
 
 	pcount = PySequence_Size(obj);
 
 	pushJsonbValue(jsonb_state, WJB_BEGIN_ARRAY, NULL);
 
-	for (i = 0; i < pcount; i++)
+	PG_TRY();
 	{
-		PyObject   *value = PySequence_GetItem(obj, i);
-
-		(void) PLyObject_ToJsonbValue(value, jsonb_state, true);
+		for (i = 0; i < pcount; i++)
+		{
+			value = PySequence_GetItem(obj, i);
+			Assert(value);
 
+			(void) PLyObject_ToJsonbValue(value, jsonb_state, true);
+			Py_XDECREF(value);
+			value = NULL;
+		}
+	}
+	PG_CATCH();
+	{
 		Py_XDECREF(value);
+		PG_RE_THROW();
 	}
+	PG_END_TRY();
 
 	return pushJsonbValue(jsonb_state, WJB_END_ARRAY, NULL);
 }

Original file line number	Diff line number	Diff line change
`@@ -128,9 +128,9 @@ Datum`
`128`	`128`	`plpython_to_hstore(PG_FUNCTION_ARGS)`
`129`	`129`	`{`
`130`	`130`	`PyObject *dict;`
`131`		`- PyObject *volatile items = NULL;`
`132`		`- int32 pcount;`
`133`		`- HStore *out;`
	`131`	`+ PyObject *volatile items;`
	`132`	`+ Py_ssize_t pcount;`
	`133`	`+ HStore *volatile out;`
`134`	`134`
`135`	`135`	`dict = (PyObject *) PG_GETARG_POINTER(0);`
`136`	`136`	`if (!PyMapping_Check(dict))`
`@@ -144,7 +144,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)`
`144`	`144`	`PG_TRY();`
`145`	`145`	`{`
`146`	`146`	`int32 buflen;`
`147`		`- int32 i;`
	`147`	`+ Py_ssize_t i;`
`148`	`148`	`Pairs *pairs;`
`149`	`149`
`150`	`150`	`pairs = palloc(pcount * sizeof(*pairs));`
`@@ -176,7 +176,6 @@ plpython_to_hstore(PG_FUNCTION_ARGS)`
`176`	`176`	`pairs[i].isnull = false;`
`177`	`177`	`}`
`178`	`178`	`}`
`179`		`- Py_DECREF(items);`
`180`	`179`
`181`	`180`	`pcount = hstoreUniquePairs(pairs, pcount, &buflen);`
`182`	`181`	`out = hstorePairs(pairs, pcount, buflen);`
`@@ -188,5 +187,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)`
`188`	`187`	`}`
`189`	`188`	`PG_END_TRY();`
`190`	`189`
	`190`	`+ Py_DECREF(items);`
	`191`	`+`
`191`	`192`	`PG_RETURN_POINTER(out);`
`192`	`193`	`}`