diff --git a/NEWS b/NEWS index 6746d379..aac97bf5 100644 --- a/NEWS +++ b/NEWS @@ -20,6 +20,7 @@ What's new in psycopg 2.4.7 the superclass init (:ticket:`#195`). - Fixed overflow opening a lobject with an oid not fitting in a signed int (:ticket:`#203`). + - Fixed possible segfault in named cursors creation. - Fixed debug build on Windows, thanks to James Emerton. diff --git a/psycopg/cursor_type.c b/psycopg/cursor_type.c index 5f5e49d2..8cc391bc 100644 --- a/psycopg/cursor_type.c +++ b/psycopg/cursor_type.c @@ -1814,31 +1814,34 @@ cursor_init(PyObject *obj, PyObject *args, PyObject *kwargs) { PyObject *conn; PyObject *name = Py_None; - const char *cname; + PyObject *bname = NULL; + const char *cname = NULL; + int rv = -1; static char *kwlist[] = {"conn", "name", NULL}; if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O!|O", kwlist, &connectionType, &conn, &name)) { - return -1; + goto exit; } - if (name == Py_None) { - cname = NULL; - } else { + if (name != Py_None) { Py_INCREF(name); /* for ensure_bytes */ - if (!(name = psycopg_ensure_bytes(name))) { + if (!(bname = psycopg_ensure_bytes(name))) { /* name has had a ref stolen */ - return -1; + goto exit; } - Py_DECREF(name); - if (!(cname = Bytes_AsString(name))) { - return -1; + if (!(cname = Bytes_AsString(bname))) { + goto exit; } } - return cursor_setup((cursorObject *)obj, (connectionObject *)conn, cname); + rv = cursor_setup((cursorObject *)obj, (connectionObject *)conn, cname); + +exit: + Py_XDECREF(bname); + return rv; } static PyObject *