diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2017-11-28 11:28:05 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2017-11-28 11:28:05 -0500 |
| commit | e42e2f38907681c48c43f49c5ec9f9f41a9aa9a5 (patch) | |
| tree | d3e674f25c4613d648fb3756dcaad8624b06f30a | |
| parent | 7b88d63a9122646ead60c1afffc248a31d4e457d (diff) | |
| download | postgresql-e42e2f38907681c48c43f49c5ec9f9f41a9aa9a5.tar.gz postgresql-e42e2f38907681c48c43f49c5ec9f9f41a9aa9a5.zip | |
PL/Python: Fix potential NULL pointer dereference
After d0aa965c0a0ac2ff7906ae1b1dad50a7952efa56, one error path in
PLy_spi_execute_fetch_result() could result in the variable "result"
being dereferenced after being set to NULL. To fix that, just clear the
resources right there and return early.
Also add another SPI_freetuptable() call so that that is cleared in all
error paths.
discovered by John Naylor <jcnaylor@gmail.com> via scan-build
| -rw-r--r-- | src/pl/plpython/plpy_spi.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/pl/plpython/plpy_spi.c b/src/pl/plpython/plpy_spi.c index ade27f39242..c80ccf6129b 100644 --- a/src/pl/plpython/plpy_spi.c +++ b/src/pl/plpython/plpy_spi.c @@ -361,7 +361,10 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status) result = (PLyResultObject *) PLy_result_new(); if (!result) + { + SPI_freetuptable(tuptable); return NULL; + } Py_DECREF(result->status); result->status = PyInt_FromLong(status); @@ -414,7 +417,9 @@ PLy_spi_execute_fetch_result(SPITupleTable *tuptable, uint64 rows, int status) if (!result->rows) { Py_DECREF(result); - result = NULL; + MemoryContextDelete(cxt); + SPI_freetuptable(tuptable); + return NULL; } else { |