[python] [patch] PR python/13331

[Phil Muldoon <pmuldoon@redhat.com>]

David Malcolm's GCC plug-in Python reference checker:

https://fedorahosted.org/gcc-python-plugin/

Found a path in our code that could result in a segfault.  We do not
sanity check the result PyTuple_New and cascade those failures later
when we try to reference the bogus tuple.  This one was a little
trickier to fix, as I had to adjust the callers to expect the failure.
For some reason, the diff of this patch is ugly, but the summary is as
follows:

- Return NULL if PyTuple_New fails.
- In the caller, check if args is NULL.  If it is, do not call the
  convenience function, and skip onto the exception -> error converter.

OK?

Cheers,

Phil

--

2011-10-24  Phil Muldoon  <pmuldoon@redhat.com>

        PR python/13331

	* python/py-function.c (fnpy_call): Check 'args' is not NULL.
	(convert_values_to_python): Return on Python tuple allocation
	failure.

--

Index: python/py-function.c
===================================================================
RCS file: /cvs/src/src/gdb/python/py-function.c,v
retrieving revision 1.10
diff -u -r1.10 py-function.c
--- python/py-function.c	5 Aug 2011 14:24:10 -0000	1.10
+++ python/py-function.c	24 Oct 2011 13:15:38 -0000
@@ -38,6 +38,9 @@
 {
   int i;
   PyObject *result = PyTuple_New (argc);
+  
+  if (! result)
+    return NULL;
 
   for (i = 0; i < argc; ++i)
     {
@@ -59,24 +62,35 @@
 	   void *cookie, int argc, struct value **argv)
 {
   struct value *value = NULL;
-  PyObject *result, *callable, *args;
+  /* 'result' must be set to NULL, this initially indicates whether
+     the function was called, or not.  */
+  PyObject *result = NULL;
+  PyObject *callable, *args;
   struct cleanup *cleanup;
 
   cleanup = ensure_python_env (gdbarch, language);
 
   args = convert_values_to_python (argc, argv);
+  /* convert_values_to_python can return NULL on error.  If we
+     encounter this, do not call the function, but allow the Python ->
+     error code conversion below to deal with the Python exception.
+     Note, that this is different if the function simply does not
+     have arguments.  */
 
-  callable = PyObject_GetAttrString ((PyObject *) cookie, "invoke");
-  if (! callable)
+  if (args)
     {
+      callable = PyObject_GetAttrString ((PyObject *) cookie, "invoke");
+      if (! callable)
+	{
+	  Py_DECREF (args);
+	  error (_("No method named 'invoke' in object."));
+	}
+
+      result = PyObject_Call (callable, args, NULL);
+      Py_DECREF (callable);
       Py_DECREF (args);
-      error (_("No method named 'invoke' in object."));
     }
 
-  result = PyObject_Call (callable, args, NULL);
-  Py_DECREF (callable);
-  Py_DECREF (args);
-
   if (!result)
     {
       PyObject *ptype, *pvalue, *ptraceback;