bpo-31544: Fix a reference leak to 'self' after the previous target error handling fixes. (GH-6318)

scoder · serhiy-storchaka · commit c498cd8bf81f · 2018-03-31T15:23:30.000+03:00
This change generally splits the xmlparser creation code into an unsafe part with "rollback" error handling and a safe "object initialisation done" part with normal decref cleanup.
diff --git a/Misc/NEWS.d/next/Library/2017-09-13-19-55-35.bpo-31455.beTh6t.rst b/Misc/NEWS.d/next/Library/2017-09-13-19-55-35.bpo-31455.beTh6t.rst
@@ -0,0 +1,2 @@
+The C accelerator module of ElementTree ignored exceptions raised when
+looking up TreeBuilder target methods in XMLParser().
diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
@@ -2575,14 +2575,24 @@ xmlparser(PyObject* self_, PyObject* args, PyObject* kw)
         return NULL;
     }
 
+    ALLOC(sizeof(XMLParserObject), "create expatparser");
+
+    /* Init to NULL to keep the error handling below manageable. */
+    self->target =
+        self->handle_xml =
+        self->handle_start =
+        self->handle_data =
+        self->handle_end =
+        self->handle_comment =
+        self->handle_pi =
+        self->handle_close =
+        NULL;
+
     /* setup target handlers */
     if (!target) {
         target = treebuilder_new();
         if (!target) {
-            EXPAT(ParserFree)(self->parser);
-            PyObject_Del(self->names);
-            PyObject_Del(self->entity);
-            PyObject_Del(self);
+            Py_DECREF(self);
             return NULL;
         }
     } else
@@ -2591,30 +2601,37 @@ xmlparser(PyObject* self_, PyObject* args, PyObject* kw)
 
     self->handle_xml = PyObject_GetAttrString(target, "xml");
     if (ignore_attribute_error(self->handle_xml)) {
+        Py_DECREF(self);
         return NULL;
     }
     self->handle_start = PyObject_GetAttrString(target, "start");
     if (ignore_attribute_error(self->handle_start)) {
+        Py_DECREF(self);
         return NULL;
     }
     self->handle_data = PyObject_GetAttrString(target, "data");
     if (ignore_attribute_error(self->handle_data)) {
+        Py_DECREF(self);
         return NULL;
     }
     self->handle_end = PyObject_GetAttrString(target, "end");
     if (ignore_attribute_error(self->handle_end)) {
+        Py_DECREF(self);
         return NULL;
     }
     self->handle_comment = PyObject_GetAttrString(target, "comment");
     if (ignore_attribute_error(self->handle_comment)) {
+        Py_DECREF(self);
         return NULL;
     }
     self->handle_pi = PyObject_GetAttrString(target, "pi");
     if (ignore_attribute_error(self->handle_pi)) {
+        Py_DECREF(self);
         return NULL;
     }
     self->handle_close = PyObject_GetAttrString(target, "close");
     if (ignore_attribute_error(self->handle_close)) {
+        Py_DECREF(self);
         return NULL;
     }
 
@@ -2650,8 +2667,6 @@ xmlparser(PyObject* self_, PyObject* args, PyObject* kw)
         );
 #endif
 
-    ALLOC(sizeof(XMLParserObject), "create expatparser");
-
     return (PyObject*) self;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+The C accelerator module of ElementTree ignored exceptions raised when`
	`2`	`+looking up TreeBuilder target methods in XMLParser().`