[Python-3000-checkins] r66047 - in python/branches/py3k: Include/object.h Misc/NEWS Modules/binascii.c Objects/abstract.c Python/getargs.c

[benjamin.peterson]

Author: benjamin.peterson
Date: Wed Aug 27 02:31:37 2008
New Revision: 66047

Log:
Fix #3651 various memory leaks when using the buffer interface

by Amaury Forgeot d'Arc
Reviewer: Antoine Pitrou


Modified:
python/branches/py3k/Include/object.h
python/branches/py3k/Misc/NEWS
python/branches/py3k/Modules/binascii.c
python/branches/py3k/Objects/abstract.c
python/branches/py3k/Python/getargs.c

Modified: python/branches/py3k/Include/object.h
==============================================================================
--- python/branches/py3k/Include/object.h (original)
+++ python/branches/py3k/Include/object.h Wed Aug 27 02:31:37 2008
@@ -143,7 +143,7 @@
/* buffer interface */
typedef struct bufferinfo {
void *buf;
- PyObject *obj; /* borrowed reference */
+ PyObject *obj; /* owned reference */
Py_ssize_t len;
Py_ssize_t itemsize; /* This is Py_ssize_t so it can be
pointed to by strides in simple case.*/

Modified: python/branches/py3k/Misc/NEWS
==============================================================================
--- python/branches/py3k/Misc/NEWS (original)
+++ python/branches/py3k/Misc/NEWS Wed Aug 27 02:31:37 2008
@@ -21,6 +21,10 @@

- Issue #3663: Py_None was decref'd when printing SyntaxErrors.

+- Issue #3651: Fix various memory leaks when using the buffer
+ interface, or when the "s#" code of PyArg_ParseTuple is given a
+ bytes object.
+
- Issue #3657: Fix uninitialized memory read when pickling longs.
Found by valgrind.


Modified: python/branches/py3k/Modules/binascii.c
==============================================================================
--- python/branches/py3k/Modules/binascii.c (original)
+++ python/branches/py3k/Modules/binascii.c Wed Aug 27 02:31:37 2008
@@ -231,6 +231,7 @@
*/
if ( this_ch < ' ' || this_ch > (' ' + 64)) {
PyErr_SetString(Error, "Illegal char");
+ PyBuffer_Release(&pascii);
Py_DECREF(rv);
return NULL;
}
@@ -259,6 +260,7 @@
if ( this_ch != ' ' && this_ch != ' '+64 &&
this_ch != '\n' && this_ch != '\r' ) {
PyErr_SetString(Error, "Trailing garbage");
+ PyBuffer_Release(&pascii);
Py_DECREF(rv);
return NULL;
}
@@ -805,6 +807,7 @@
** of the string only). This is a programmer error.
*/
PyErr_SetString(Error, "Orphaned RLE code at start");
+ PyBuffer_Release(&pin);
Py_DECREF(rv);
return NULL;
}

Modified: python/branches/py3k/Objects/abstract.c
==============================================================================
--- python/branches/py3k/Objects/abstract.c (original)
+++ python/branches/py3k/Objects/abstract.c Wed Aug 27 02:31:37 2008
@@ -260,6 +260,7 @@
*buffer_len = view.len;
if (pb->bf_releasebuffer != NULL)
(*pb->bf_releasebuffer)(obj, &view);
+ Py_XDECREF(view.obj);
return 0;
}

@@ -305,6 +306,7 @@
*buffer_len = view.len;
if (pb->bf_releasebuffer != NULL)
(*pb->bf_releasebuffer)(obj, &view);
+ Py_XDECREF(view.obj);
return 0;
}

@@ -332,6 +334,7 @@
*buffer_len = view.len;
if (pb->bf_releasebuffer != NULL)
(*pb->bf_releasebuffer)(obj, &view);
+ Py_XDECREF(view.obj);
return 0;
}


Modified: python/branches/py3k/Python/getargs.c
==============================================================================
--- python/branches/py3k/Python/getargs.c (original)
+++ python/branches/py3k/Python/getargs.c Wed Aug 27 02:31:37 2008
@@ -1245,7 +1245,7 @@
/* Caller is interested in Py_buffer, and the object
supports it directly. */
format++;
- if (pb->bf_getbuffer(arg, (Py_buffer*)p, PyBUF_WRITABLE) < 0) {
+ if (PyObject_GetBuffer(arg, (Py_buffer*)p, PyBUF_WRITABLE) < 0) {
PyErr_Clear();
return converterr("read-write buffer", arg, msgbuf, bufsize);
}
@@ -1257,11 +1257,11 @@
/* Here we have processed w*, only w and w# remain. */
if (pb == NULL ||
pb->bf_getbuffer == NULL ||
- ((temp = (*pb->bf_getbuffer)(arg, &view,
- PyBUF_SIMPLE)) != 0) ||
+ ((temp = PyObject_GetBuffer(arg, &view,
+ PyBUF_SIMPLE)) != 0) ||
view.readonly == 1) {
- if (temp==0 && pb->bf_releasebuffer != NULL) {
- (*pb->bf_releasebuffer)(arg, &view);
+ if (temp==0) {
+ PyBuffer_Release(&view);
}
return converterr("single-segment read-write buffer",
arg, msgbuf, bufsize);
@@ -1295,7 +1295,7 @@
"bytes or read-only character buffer",
arg, msgbuf, bufsize);

- if ((*pb->bf_getbuffer)(arg, &view, PyBUF_SIMPLE) != 0)
+ if (PyObject_GetBuffer(arg, &view, PyBUF_SIMPLE) != 0)
return converterr("string or single-segment read-only buffer",
arg, msgbuf, bufsize);

@@ -1306,6 +1306,8 @@
"string or pinned buffer",
arg, msgbuf, bufsize);

+ PyBuffer_Release(&view);
+
if (count < 0)
return converterr("(unspecified)", arg, msgbuf, bufsize);
{
@@ -1340,14 +1342,13 @@
return -1;
}

- if ((*pb->bf_getbuffer)(arg, &view, PyBUF_SIMPLE) != 0) {
+ if (PyObject_GetBuffer(arg, &view, PyBUF_SIMPLE) != 0) {
*errmsg = "bytes or single-segment read-only buffer";
return -1;
}
count = view.len;
*p = view.buf;
- if (pb->bf_releasebuffer != NULL)
- (*pb->bf_releasebuffer)(arg, &view);
+ PyBuffer_Release(&view);
return count;
}

@@ -1364,7 +1365,7 @@
return -1;
}
if (pb->bf_getbuffer) {
- if (pb->bf_getbuffer(arg, view, 0) < 0) {
+ if (PyObject_GetBuffer(arg, view, 0) < 0) {
*errmsg = "convertible to a buffer";
return -1;
}