PySocket_getaddrinfo(): fix two refcount bugs, both having to do with

a misunderstanding of the refcont behavior of the 'O' format code in
PyArg_ParseTuple() and Py_BuildValue(), respectively.

- pobj is only a borrowed reference, so should *not* be DECREF'ed at
  the end.  This was the cause of SF bug #470635.

- The Py_BuildValue() call would leak the object produced by
  makesockaddr().  (I found this by eyeballing the code.)

1 files changed, 6 insertions, 3 deletions

diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index 56e3700..2ca99c9 100644
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -2377,10 +2377,15 @@ PySocket_getaddrinfo(PyObject *self, PyObject *args)
 	if ((all = PyList_New(0)) == NULL)
 		goto err;
 	for (res = res0; res; res = res->ai_next) {
+		PyObject *addr =
+			makesockaddr(-1, res->ai_addr, res->ai_addrlen);
+		if (addr == NULL)
+			goto err;
 		single = Py_BuildValue("iiisO", res->ai_family,
 			res->ai_socktype, res->ai_protocol,
 			res->ai_canonname ? res->ai_canonname : "",
-			makesockaddr(-1, res->ai_addr, res->ai_addrlen));
+			addr);
+		Py_DECREF(addr);
 		if (single == NULL)
 			goto err;
 
@@ -2388,12 +2393,10 @@ PySocket_getaddrinfo(PyObject *self, PyObject *args)
 			goto err;
 		Py_XDECREF(single);
 	}
-	Py_XDECREF(pobj);
 	return all;
  err:
 	Py_XDECREF(single);
 	Py_XDECREF(all);
-	Py_XDECREF(pobj);
 	return (PyObject *)NULL;
 }