Fix use after free issue in inserttable() (#71)

PyGreSQL · Mar 22, 2022 · c55d003 · c55d003
1 parent d8c2be7
commit c55d003
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/docs/contents/changelog.rst b/docs/contents/changelog.rst
@@ -1,6 +1,12 @@
 ChangeLog
 =========
 
+Version 5.2.4 (to be released)
+------------------------------
+- Two more fixes in the `inserttable()` method of the `pg` module:
+    - `inserttable()` failed to escape carriage return (#68)
+    - Fix use after free issue in `inserttable()` (#71)
+
 Version 5.2.3 (2022-01-30)
 --------------------------
 - This version officially supports the new Python 3.10 and PostgreSQL 14.

diff --git a/pgconn.c b/pgconn.c
@@ -775,24 +775,24 @@ conn_inserttable(connObject *self, PyObject *args)
             char *col;
 
             if (PyBytes_Check(obj)) {
-                PyBytes_AsStringAndSize(obj, &col, &slen);
+                Py_INCREF(obj);
             }
             else if (PyUnicode_Check(obj)) {
                 obj = get_encoded_string(obj, encoding);
                 if (!obj) {
                     PyMem_Free(buffer); Py_DECREF(iter_row);
                     return NULL; /* pass the UnicodeEncodeError */
                 }
-                PyBytes_AsStringAndSize(obj, &col, &slen);
-                Py_DECREF(obj);
             } else {
                 PyErr_SetString(
                     PyExc_TypeError,
                     "The third argument must contain only strings");
                 PyMem_Free(buffer); Py_DECREF(iter_row);
                 return NULL;
             }
+            PyBytes_AsStringAndSize(obj, &col, &slen);
             col = PQescapeIdentifier(self->cnx, col, (size_t) slen);
+            Py_DECREF(obj);
             if (bufpt < bufmax)
                 bufpt += snprintf(bufpt, (size_t) (bufmax - bufpt),
                     "%s%s", col, j == n - 1 ? ")" : ",");