Avoid Python memory leaks in hstore_plpython and jsonb_plpython.

Fix some places where we might fail to do Py_DECREF() on a Python
object (thereby leaking it for the rest of the session).  Almost
all of the risks were in error-recovery paths, which we don't really
expect to hit anyway.  Hence, while this is definitely a bug fix,
it doesn't quite seem worth back-patching.

Nikita Glukhov, Michael Paquier, Tom Lane

Discussion: https://postgr.es/m/28053a7d-10d8-fc23-b05c-b4749c873f63@postgrespro.ru

diff --git a/contrib/hstore_plpython/hstore_plpython.c b/contrib/hstore_plpython/hstore_plpython.c
index 93c39d294dd439f4fa7752283fe643ac4a4d2dc6..93705f0d54cb4b809261bf1d80f694a49976de1b 100644 (file)
--- a/contrib/hstore_plpython/hstore_plpython.c
+++ b/contrib/hstore_plpython/hstore_plpython.c
@@ -128,9 +128,9 @@ Datum
 plpython_to_hstore(PG_FUNCTION_ARGS)
 {
        PyObject   *dict;
-       PyObject *volatile items = NULL;
-       int32           pcount;
-       HStore     *out;
+       PyObject   *volatile items;
+       Py_ssize_t      pcount;
+       HStore     *volatile out;
 
        dict = (PyObject *) PG_GETARG_POINTER(0);
        if (!PyMapping_Check(dict))
@@ -144,7 +144,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
        PG_TRY();
        {
                int32           buflen;
-               int32           i;
+               Py_ssize_t      i;
                Pairs      *pairs;
 
                pairs = palloc(pcount * sizeof(*pairs));
@@ -176,7 +176,6 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
                                pairs[i].isnull = false;
                        }
                }
-               Py_DECREF(items);
 
                pcount = hstoreUniquePairs(pairs, pcount, &buflen);
                out = hstorePairs(pairs, pcount, buflen);
@@ -188,5 +187,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
        }
        PG_END_TRY();
 
+       Py_DECREF(items);
+
        PG_RETURN_POINTER(out);
 }

diff --git a/contrib/jsonb_plpython/jsonb_plpython.c b/contrib/jsonb_plpython/jsonb_plpython.c
index 1bc984d5c4d9dbaacaa3675c2da2d7d0e8f4b657..24e7c6559d63fb9b77141c427625df835f261330 100644 (file)
--- a/contrib/jsonb_plpython/jsonb_plpython.c
+++ b/contrib/jsonb_plpython/jsonb_plpython.c
@@ -164,56 +164,91 @@ PLyObject_FromJsonbContainer(JsonbContainer *jsonb)
                        }
                        else
                        {
-                               /* array in v */
+                               PyObject   *volatile elem = NULL;
+
                                result = PyList_New(0);
                                if (!result)
                                        return NULL;
 
-                               while ((r = JsonbIteratorNext(&it, &v, true)) != WJB_DONE)
+                               PG_TRY();
                                {
-                                       if (r == WJB_ELEM)
+                                       while ((r = JsonbIteratorNext(&it, &v, true)) != WJB_DONE)
                                        {
-                                               PyObject   *elem = PLyObject_FromJsonbValue(&v);
+                                               if (r != WJB_ELEM)
+                                                       continue;
+
+                                               elem = PLyObject_FromJsonbValue(&v);
 
                                                PyList_Append(result, elem);
                                                Py_XDECREF(elem);
+                                               elem = NULL;
                                        }
                                }
+                               PG_CATCH();
+                               {
+                                       Py_XDECREF(elem);
+                                       Py_XDECREF(result);
+                                       PG_RE_THROW();
+                               }
+                               PG_END_TRY();
                        }
                        break;
 
                case WJB_BEGIN_OBJECT:
-                       result = PyDict_New();
-                       if (!result)
-                               return NULL;
-
-                       while ((r = JsonbIteratorNext(&it, &v, true)) != WJB_DONE)
                        {
-                               if (r == WJB_KEY)
-                               {
-                                       PyObject   *key = PLyString_FromJsonbValue(&v);
+                               PyObject   *volatile result_v = PyDict_New();
+                               PyObject   *volatile key = NULL;
+                               PyObject   *volatile val = NULL;
 
-                                       if (!key)
-                                               return NULL;
-
-                                       r = JsonbIteratorNext(&it, &v, true);
+                               if (!result_v)
+                                       return NULL;
 
-                                       if (r == WJB_VALUE)
+                               PG_TRY();
+                               {
+                                       while ((r = JsonbIteratorNext(&it, &v, true)) != WJB_DONE)
                                        {
-                                               PyObject   *value = PLyObject_FromJsonbValue(&v);
+                                               if (r != WJB_KEY)
+                                                       continue;
 
-                                               if (!value)
+                                               key = PLyString_FromJsonbValue(&v);
+                                               if (!key)
+                                               {
+                                                       Py_XDECREF(result_v);
+                                                       result_v = NULL;
+                                                       break;
+                                               }
+
+                                               if ((r = JsonbIteratorNext(&it, &v, true)) != WJB_VALUE)
+                                                       elog(ERROR, "unexpected jsonb token: %d", r);
+
+                                               val = PLyObject_FromJsonbValue(&v);
+                                               if (!val)
                                                {
                                                        Py_XDECREF(key);
-                                                       return NULL;
+                                                       key = NULL;
+                                                       Py_XDECREF(result_v);
+                                                       result_v = NULL;
+                                                       break;
                                                }
 
-                                               PyDict_SetItem(result, key, value);
-                                               Py_XDECREF(value);
-                                       }
+                                               PyDict_SetItem(result_v, key, val);
 
+                                               Py_XDECREF(key);
+                                               key = NULL;
+                                               Py_XDECREF(val);
+                                               val = NULL;
+                                       }
+                               }
+                               PG_CATCH();
+                               {
+                                       Py_XDECREF(result_v);
                                        Py_XDECREF(key);
+                                       Py_XDECREF(val);
+                                       PG_RE_THROW();
                                }
+                               PG_END_TRY();
+
+                               result = result_v;
                        }
                        break;
 
@@ -234,10 +269,8 @@ static JsonbValue *
 PLyMapping_ToJsonbValue(PyObject *obj, JsonbParseState **jsonb_state)
 {
        Py_ssize_t      pcount;
-       JsonbValue *out = NULL;
-
-       /* We need it volatile, since we use it after longjmp */
-       PyObject *volatile items = NULL;
+       PyObject   *volatile items;
+       JsonbValue *volatile out;
 
        pcount = PyMapping_Size(obj);
        items = PyMapping_Items(obj);
@@ -281,6 +314,8 @@ PLyMapping_ToJsonbValue(PyObject *obj, JsonbParseState **jsonb_state)
        }
        PG_END_TRY();
 
+       Py_DECREF(items);
+
        return out;
 }
 
@@ -295,19 +330,30 @@ PLySequence_ToJsonbValue(PyObject *obj, JsonbParseState **jsonb_state)
 {
        Py_ssize_t      i;
        Py_ssize_t      pcount;
+       PyObject   *volatile value = NULL;
 
        pcount = PySequence_Size(obj);
 
        pushJsonbValue(jsonb_state, WJB_BEGIN_ARRAY, NULL);
 
-       for (i = 0; i < pcount; i++)
+       PG_TRY();
        {
-               PyObject   *value = PySequence_GetItem(obj, i);
-
-               (void) PLyObject_ToJsonbValue(value, jsonb_state, true);
+               for (i = 0; i < pcount; i++)
+               {
+                       value = PySequence_GetItem(obj, i);
+                       Assert(value);
 
+                       (void) PLyObject_ToJsonbValue(value, jsonb_state, true);
+                       Py_XDECREF(value);
+                       value = NULL;
+               }
+       }
+       PG_CATCH();
+       {
                Py_XDECREF(value);
+               PG_RE_THROW();
        }
+       PG_END_TRY();
 
        return pushJsonbValue(jsonb_state, WJB_END_ARRAY, NULL);
 }