Fix access-to-already-freed-memory issue in plpython's error handling.

PLy_elog() could attempt to access strings that Python had already freed,
because the strings that PLy_get_spi_error_data() returns are simply
pointers into storage associated with the error "val" PyObject.  That's
fine at the instant PLy_get_spi_error_data() returns them, but just after
that PLy_traceback() intentionally releases the only refcount on that
object, allowing it to be freed --- so that the strings we pass to
ereport() are dangling pointers.

In principle this could result in garbage output or a coredump.  In
practice, I think the risk is pretty low, because there are no Python
operations between where we decrement that refcount and where we use the
strings (and copy them into PG storage), and thus no reason for Python
to recycle the storage.  Still, it's clearly hazardous, and it leads to
Valgrind complaints when running under a Valgrind that hasn't been
lobotomized to ignore Python memory allocations.

The code was a mess anyway: we fetched the error data out of Python
(clearing Python's error indicator) with PyErr_Fetch, examined it, pushed
it back into Python with PyErr_Restore (re-setting the error indicator),
then immediately pulled it back out with another PyErr_Fetch.  Just to
confuse matters even more, there were some gratuitous-and-yet-hazardous
PyErr_Clear calls in the "examine" step, and we didn't get around to doing
PyErr_NormalizeException until after the second PyErr_Fetch, making it even
less clear which object was being manipulated where and whether we still
had a refcount on it.  (If PyErr_NormalizeException did substitute a
different "val" object, it's possible that the problem could manifest for
real, because then we'd be doing assorted Python stuff with no refcount
on the object we have string pointers into.)

So, rearrange all that into some semblance of sanity, and don't decrement
the refcount on the Python error objects until the end of PLy_elog().
In HEAD, I failed to resist the temptation to reformat some messy bits
from 5c3c3cd0a3046339 along the way.

Back-patch as far as 9.2, because the code is substantially the same
that far back.  I believe that 9.1 has the bug as well; but the code
around it is rather different and I don't want to take a chance on
breaking something for what seems a low-probability problem.

diff --git a/src/pl/plpython/plpy_elog.c b/src/pl/plpython/plpy_elog.c
index 15406d60b9012a5e48ae99e802b8c10d567fe46c..55d9e283f1090a3ebce149b2ec23c6035e8371f4 100644 (file)
--- a/src/pl/plpython/plpy_elog.c
+++ b/src/pl/plpython/plpy_elog.c
@@ -21,7 +21,8 @@ PyObject   *PLy_exc_fatal = NULL;
 PyObject   *PLy_exc_spi_error = NULL;
 
 
-static void PLy_traceback(char **xmsg, char **tbmsg, int *tb_depth);
+static void PLy_traceback(PyObject *e, PyObject *v, PyObject *tb,
+             char **xmsg, char **tbmsg, int *tb_depth);
 static void PLy_get_spi_error_data(PyObject *exc, int *sqlerrcode, char **detail,
                       char **hint, char **query, int *position);
 static char *get_source_line(const char *src, int lineno);
@@ -53,16 +54,20 @@ PLy_elog(int elevel, const char *fmt,...)
    int         position = 0;
 
    PyErr_Fetch(&exc, &val, &tb);
+
    if (exc != NULL)
    {
+       PyErr_NormalizeException(&exc, &val, &tb);
+
        if (PyErr_GivenExceptionMatches(val, PLy_exc_spi_error))
            PLy_get_spi_error_data(val, &sqlerrcode, &detail, &hint, &query, &position);
        else if (PyErr_GivenExceptionMatches(val, PLy_exc_fatal))
            elevel = FATAL;
    }
-   PyErr_Restore(exc, val, tb);
 
-   PLy_traceback(&xmsg, &tbmsg, &tb_depth);
+   /* this releases our refcount on tb! */
+   PLy_traceback(exc, val, tb,
+                 &xmsg, &tbmsg, &tb_depth);
 
    if (fmt)
    {
@@ -113,6 +118,9 @@ PLy_elog(int elevel, const char *fmt,...)
            pfree(xmsg);
        if (tbmsg)
            pfree(tbmsg);
+       Py_XDECREF(exc);
+       Py_XDECREF(val);
+
        PG_RE_THROW();
    }
    PG_END_TRY();
@@ -123,21 +131,24 @@ PLy_elog(int elevel, const char *fmt,...)
        pfree(xmsg);
    if (tbmsg)
        pfree(tbmsg);
+   Py_XDECREF(exc);
+   Py_XDECREF(val);
 }
 
 /*
- * Extract a Python traceback from the current exception.
+ * Extract a Python traceback from the given exception data.
  *
  * The exception error message is returned in xmsg, the traceback in
  * tbmsg (both as palloc'd strings) and the traceback depth in
  * tb_depth.
+ *
+ * We release refcounts on all the Python objects in the traceback stack,
+ * but not on e or v.
  */
 static void
-PLy_traceback(char **xmsg, char **tbmsg, int *tb_depth)
+PLy_traceback(PyObject *e, PyObject *v, PyObject *tb,
+             char **xmsg, char **tbmsg, int *tb_depth)
 {
-   PyObject   *e,
-              *v,
-              *tb;
    PyObject   *e_type_o;
    PyObject   *e_module_o;
    char       *e_type_s = NULL;
@@ -148,12 +159,7 @@ PLy_traceback(char **xmsg, char **tbmsg, int *tb_depth)
    StringInfoData tbstr;
 
    /*
-    * get the current exception
-    */
-   PyErr_Fetch(&e, &v, &tb);
-
-   /*
-    * oops, no exception, return
+    * if no exception, return nulls
     */
    if (e == NULL)
    {
@@ -164,8 +170,6 @@ PLy_traceback(char **xmsg, char **tbmsg, int *tb_depth)
        return;
    }
 
-   PyErr_NormalizeException(&e, &v, &tb);
-
    /*
     * Format the exception and its value and put it in xmsg.
     */
@@ -332,8 +336,6 @@ PLy_traceback(char **xmsg, char **tbmsg, int *tb_depth)
    Py_XDECREF(e_type_o);
    Py_XDECREF(e_module_o);
    Py_XDECREF(vob);
-   Py_XDECREF(v);
-   Py_DECREF(e);
 }
 
 /*
@@ -367,7 +369,7 @@ PLy_get_spi_sqlerrcode(PyObject *exc, int *sqlerrcode)
 static void
 PLy_get_spi_error_data(PyObject *exc, int *sqlerrcode, char **detail, char **hint, char **query, int *position)
 {
-   PyObject   *spidata = NULL;
+   PyObject   *spidata;
 
    spidata = PyObject_GetAttrString(exc, "spidata");
 
@@ -384,8 +386,6 @@ PLy_get_spi_error_data(PyObject *exc, int *sqlerrcode, char **detail, char **hin
        PLy_get_spi_sqlerrcode(exc, sqlerrcode);
    }
 
-   PyErr_Clear();
-   /* no elog here, we simply won't report the errhint, errposition etc */
    Py_XDECREF(spidata);
 }