Issue #22453: Fexed reference leaks when format error messages in ceval.c.

Warn against the use of leaking macro PyObject_REPR().

diff --git a/Include/object.h b/Include/object.h
index afbc68dc04e9412134dfd60bd87608656e4d1e8b..4ee1f8e6fb48fa7bdf042e4a55aeffd32b7e9426 100644 (file)
--- a/Include/object.h
+++ b/Include/object.h
@@ -527,7 +527,9 @@ PyAPI_DATA(_Py_HashSecret_t) _Py_HashSecret;
 PyAPI_DATA(int) _Py_HashSecret_Initialized;
 #endif
 
-/* Helper for passing objects to printf and the like */
+/* Helper for passing objects to printf and the like.
+   Leaks refcounts.  Don't use it!
+*/
 #define PyObject_REPR(obj) PyString_AS_STRING(PyObject_Repr(obj))
 
 /* Flag bits for printing: */

diff --git a/Python/ceval.c b/Python/ceval.c
index e00860831f15f3d4425db0f42b167628480da45b..dad5e1cdc9606f46a48ce9b536635531722cf3f9 100644 (file)
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -1957,9 +1957,13 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                 if (err == 0) continue;
                 break;
             }
+            t = PyObject_Repr(w);
+            if (t == NULL)
+                break;
             PyErr_Format(PyExc_SystemError,
                          "no locals found when storing %s",
-                         PyObject_REPR(w));
+                         PyString_AS_STRING(t));
+            Py_DECREF(t);
             break;
 
         case DELETE_NAME:
@@ -1971,9 +1975,13 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                                          w);
                 break;
             }
+            t = PyObject_Repr(w);
+            if (t == NULL)
+                break;
             PyErr_Format(PyExc_SystemError,
                          "no locals when deleting %s",
-                         PyObject_REPR(w));
+                         PyString_AS_STRING(w));
+            Py_DECREF(t);
             break;
 
         PREDICTED_WITH_ARG(UNPACK_SEQUENCE);
@@ -2046,10 +2054,14 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
         case LOAD_NAME:
             w = GETITEM(names, oparg);
             if ((v = f->f_locals) == NULL) {
+                why = WHY_EXCEPTION;
+                t = PyObject_Repr(w);
+                if (t == NULL)
+                    break;
                 PyErr_Format(PyExc_SystemError,
                              "no locals when loading %s",
-                             PyObject_REPR(w));
-                why = WHY_EXCEPTION;
+                             PyString_AS_STRING(w));
+                Py_DECREF(t);
                 break;
             }
             if (PyDict_CheckExact(v)) {

diff --git a/Python/compile.c b/Python/compile.c
index 1cf53f95ac615958835f5af27a14715393cfc157..9d9e62904cde4dca2a64073968a246434548748e 100644 (file)
--- a/Python/compile.c
+++ b/Python/compile.c
@@ -1271,11 +1271,11 @@ get_ref_type(struct compiler *c, PyObject *name)
                       "symbols: %s\nlocals: %s\nglobals: %s",
                       PyString_AS_STRING(name),
                       PyString_AS_STRING(c->u->u_name),
-                      PyObject_REPR(c->u->u_ste->ste_id),
+                      PyString_AS_STRING(PyObject_Repr(c->u->u_ste->ste_id)),
                       c->c_filename,
-                      PyObject_REPR(c->u->u_ste->ste_symbols),
-                      PyObject_REPR(c->u->u_varnames),
-                      PyObject_REPR(c->u->u_names)
+                      PyString_AS_STRING(PyObject_Repr(c->u->u_ste->ste_symbols)),
+                      PyString_AS_STRING(PyObject_Repr(c->u->u_varnames)),
+                      PyString_AS_STRING(PyObject_Repr(c->u->u_names))
         );
         Py_FatalError(buf);
     }
@@ -1327,11 +1327,11 @@ compiler_make_closure(struct compiler *c, PyCodeObject *co, int args)
         if (arg == -1) {
             printf("lookup %s in %s %d %d\n"
                 "freevars of %s: %s\n",
-                PyObject_REPR(name),
+                PyString_AS_STRING(PyObject_Repr(name)),
                 PyString_AS_STRING(c->u->u_name),
                 reftype, arg,
                 PyString_AS_STRING(co->co_name),
-                PyObject_REPR(co->co_freevars));
+                PyString_AS_STRING(PyObject_Repr(co->co_freevars)));
             Py_FatalError("compiler_make_closure()");
         }
         ADDOP_I(c, LOAD_CLOSURE, arg);