From 77e934e88766002e77462d541b6e9c9599c7d410 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Thu, 24 May 2018 23:36:57 +0200 Subject: [PATCH] Fix ref counting bug in LDAPmessage_to_python PyDict_GetItem() returns a borrowed reference. The code later Py_DECREF() the reference, which causes a segfault at a later point in time. Fixes: https://github.com/python-ldap/python-ldap/issues/218 Signed-off-by: Christian Heimes --- Modules/message.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Modules/message.c b/Modules/message.c index cf3ea3b..2c05488 100644 --- a/Modules/message.c +++ b/Modules/message.c @@ -99,7 +99,15 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, /* Find which list to append to */ if (PyDict_Contains(attrdict, pyattr)) { + /* Multiple attribute entries with same name. This code path + * is rarely used and cannot be exhausted with OpenLDAP + * tests. 389-DS sometimes triggeres it, see + * https://github.com/python-ldap/python-ldap/issues/218 + */ valuelist = PyDict_GetItem(attrdict, pyattr); + /* Turn borrowed reference into owned reference */ + if (valuelist != NULL) + Py_INCREF(valuelist); } else { valuelist = PyList_New(0);