From db925b1a3c4172707c21956c9b27c28fce086e02 Mon Sep 17 00:00:00 2001 From: Peter Eisentraut Date: Tue, 3 Nov 2009 08:29:51 +0000 Subject: [PATCH] Fix obscure segfault condition in PL/Python In PLy_output(), when the elog() call in the TRY branch throws an exception (this can happen when a statement timeout kicks in, for example), the PyErr_SetString() call in the CATCH branch can cause a segfault, because the Py_XDECREF(so) call before it releases memory that is still used by the sv variable that PyErr_SetString() uses as argument, because sv points into memory owned by so. Backpatched back to 8.0, where this code was introduced. I also threw in a couple of volatile declarations for variables that are used before and after the TRY. I don't think they caused the crash that I observed, but they could become issues. --- src/pl/plpython/plpython.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/pl/plpython/plpython.c b/src/pl/plpython/plpython.c index 2419ba3dd3..bd87778d06 100644 --- a/src/pl/plpython/plpython.c +++ b/src/pl/plpython/plpython.c @@ -1,7 +1,7 @@ /********************************************************************** * plpython.c - python as a procedural language for PostgreSQL * - * $PostgreSQL: pgsql/src/pl/plpython/plpython.c,v 1.90.2.4 2008/01/02 03:10:34 tgl Exp $ + * $PostgreSQL: pgsql/src/pl/plpython/plpython.c,v 1.90.2.5 2009/11/03 08:29:51 petere Exp $ * ********************************************************************* */ @@ -2814,9 +2814,9 @@ PLy_fatal(PyObject * self, PyObject * args) static PyObject * PLy_output(volatile int level, PyObject * self, PyObject * args) { - PyObject *so; + PyObject *volatile so; char *volatile sv; - MemoryContext oldcontext; + volatile MemoryContext oldcontext; so = PyObject_Str(args); if (so == NULL || ((sv = PyString_AsString(so)) == NULL)) @@ -2835,6 +2835,10 @@ PLy_output(volatile int level, PyObject * self, PyObject * args) MemoryContextSwitchTo(oldcontext); PLy_error_in_progress = CopyErrorData(); FlushErrorState(); + + PyErr_SetString(PLy_exc_error, sv); + /* Note: If sv came from PyString_AsString(), it points into + * storage owned by so. So free so after using sv. */ Py_XDECREF(so); /* @@ -2842,7 +2846,6 @@ PLy_output(volatile int level, PyObject * self, PyObject * args) * control passes back to PLy_procedure_call, we check for PG * exceptions and re-throw the error. */ - PyErr_SetString(PLy_exc_error, sv); return NULL; } PG_END_TRY();