In PLy_function_build_args(), the code loops repeatedly, constructing

one argument at a time and then inserting the argument into a Python
list via PyList_SetItem(). This "steals" the reference to the argument:
that is, the reference to the new list member is now held by the Python
list itself. This works fine, except if an elog occurs. This causes the
function's PG_CATCH() block to be invoked, which decrements the
reference counts on both the current argument and the list of arguments.
If the elog happens to occur during the second or subsequent iteration
of the loop, the reference count on the current argument will be
decremented twice.

The fix is simple: set the local pointer to the current argument to NULL
immediately after adding it to the argument list. This ensures that the
Py_XDECREF() in the PG_CATCH() block doesn't double-decrement.

diff --git a/src/pl/plpython/plpython.c b/src/pl/plpython/plpython.c
index 65bb41ea8c9b0ad5265426b2cc92cf6052bff65d..b93a94c8826634f29fbcee566a6a82f2896df95c 100644 (file)
--- a/src/pl/plpython/plpython.c
+++ b/src/pl/plpython/plpython.c
@@ -29,7 +29,7 @@
  * MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
  *
  * IDENTIFICATION
- *     $PostgreSQL: pgsql/src/pl/plpython/plpython.c,v 1.58.4.3 2005/12/29 21:47:49 neilc Exp $
+ *     $PostgreSQL: pgsql/src/pl/plpython/plpython.c,v 1.58.4.4 2006/01/10 00:33:48 neilc Exp $
  *
  *********************************************************************
  */
@@ -902,6 +902,7 @@ PLy_function_build_args(FunctionCallInfo fcinfo, PLyProcedure * proc)
                         * FIXME -- error check this
                         */
                        PyList_SetItem(args, i, arg);
+                       arg = NULL;
                }
        }
        PG_CATCH();