Creating psycopg2.extensions.Column from Python leads to a segfault

[byronclark]

While working on some test code that creates a psycopg2.extensions.Column object from Python code we discovered that creating this object is enough to trigger a segfault when the object is deleted. Admittedly the library only creates that object from C code when building the result of cursor.description() so the use case isn't entirely realistic.

Here's an example that demonstrates the crash. I've confirmed it behaves the same on Python 3.8 from Ubuntu 20.04 and Python 3.9 from Fedora 34.

Python 3.9.2 (default, Feb 20 2021, 00:00:00) 
[GCC 11.0.0 20210210 (Red Hat 11.0.0-0)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from psycopg2.extensions import Column
>>> def do_stuff():
...     foo = Column(name='my_column')
... 
>>> for _ in range(1000):
...     do_stuff()
... 
Segmentation fault (core dumped)

Here's the virtual environment for running the test:

$ pip3 freeze
psycopg2==2.8.6

[dvarrazzo]

Probably the Column object is not really meant to be created in Python. Looking at the object it seems to access heavily internal C structures.

If you would like to provide a patch I'll be happy to work, otherwise I'll leave the bug open and try a fix for it but it will have to wait some time.

[dvarrazzo]

Fixed, thank you for the test case to reproduce it.

FYI I looked at your solution, but the practice is first to incref, then to set the attribute in the C structure. Doing the opposite leaves a window for race conditions open (likely not in the constructor, but it's still better to err on the safe side).