1. future use-after-free: ob_refcnt of return value is 1 too low

    Report

    1
    static PyObject *
    _mysql_NewException(
    PyObject *dict,
    PyObject *edict,
    char *name)
    {
    PyObject *e;
    if (!(e = PyDict_GetItemString(edict, name)))
    return NULL;
    if (PyDict_SetItemString(dict, name, e)) return NULL;
    #ifdef PYPY_VERSION
    Py_INCREF(e);
    #endif
    return e;
    }
    1. when treating unknown char * from _mysql.c:2938 as non-NULL

      when PyDict_GetItemString() succeeds

      taking False path

      return value was allocated at: if (!(e = PyDict_GetItemString(edict, name)))

    2. when PyDict_SetItemString() succeeds

      taking False path

    3. was expecting final owned ob_refcnt of return value to be 1 due to object being referenced by: return value but final ob_refcnt is refs: 0 owned, 2 borrowed

  2. returning (PyObject*)NULL without setting an exception

    Report

    2
    static PyObject *
    _mysql_NewException(
    PyObject *dict,
    PyObject *edict,
    char *name)
    {
    PyObject *e;
    if (!(e = PyDict_GetItemString(edict, name)))
    return NULL;
    if (PyDict_SetItemString(dict, name, e)) return NULL;
    #ifdef PYPY_VERSION
    Py_INCREF(e);
    #endif
    return e;
    }
    1. when treating unknown char * from _mysql.c:2938 as non-NULL

      PyDict_GetItemString does not find string

      taking True path