PySocket_getaddrinfo(): fix two refcount bugs, both having to do with

a misunderstanding of the refcont behavior of the 'O' format code in
PyArg_ParseTuple() and Py_BuildValue(), respectively.

- pobj is only a borrowed reference, so should *not* be DECREF'ed at
  the end.  This was the cause of SF bug #470635.

- The Py_BuildValue() call would leak the object produced by
  makesockaddr().  (I found this by eyeballing the code.)

diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index 56e370099c1142faa1c1159a2397bc3d17241501..2ca99c96b129eadb747a0a28a39a3ed37fbf42d8 100644 (file)
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -2377,10 +2377,15 @@ PySocket_getaddrinfo(PyObject *self, PyObject *args)
        if ((all = PyList_New(0)) == NULL)
                goto err;
        for (res = res0; res; res = res->ai_next) {
+               PyObject *addr =
+                       makesockaddr(-1, res->ai_addr, res->ai_addrlen);
+               if (addr == NULL)
+                       goto err;
                single = Py_BuildValue("iiisO", res->ai_family,
                        res->ai_socktype, res->ai_protocol,
                        res->ai_canonname ? res->ai_canonname : "",
-                       makesockaddr(-1, res->ai_addr, res->ai_addrlen));
+                       addr);
+               Py_DECREF(addr);
                if (single == NULL)
                        goto err;
 
@@ -2388,12 +2393,10 @@ PySocket_getaddrinfo(PyObject *self, PyObject *args)
                        goto err;
                Py_XDECREF(single);
        }
-       Py_XDECREF(pobj);
        return all;
  err:
        Py_XDECREF(single);
        Py_XDECREF(all);
-       Py_XDECREF(pobj);
        return (PyObject *)NULL;
 }