rpm-python memory leaks

[Jeff Johnson]

(quoted from http://lists.rpm.org/pipermail/rpm-maint/2011-December/003138.html)

Various functions in the Python bindings have expressions of the form:

    PyObject_Call(callable,
                  Py_BuildValue(fmtstring, ...), NULL);

This leaks memory for the case when Py_BuildValue succeeds (it returns
a new reference, which is never freed; PyObject_Call doesn't steal the
reference): the argument tuple and all of its components will not be
freed (until the process exits).

There's also a possible segfault for the case where Py_BuildValue fails:
PyObject_Call will likely segfault with a NULL 2nd argument.

This affects:
  python/header-py.c: hdr_fiFromHeader rpm.hdr.fiFromHeader()
  python/header-py.c: hdr_dsFromHeader rpm.hdr.dsFromHeader()
  python/header-py.c: hdr_dsOfHeader rpm.hdr.dsOfHeader()
  python/rpmfd-py.c: rpmfdFromPyObject

It's better to use PyObject_CallObject:
  http://docs.python.org/c-api/object.html#PyObject_CallFunction
which can construct the argument tuple in a similar fashion to Py_BuildValue,
but handles cleanup and failures for you.

Also, if all arguments are already PyObject*, PyObject_CallFunctionObjArgs
is faster:
   http://docs.python.org/c-api/object.html#PyObject_CallFunctionObjArgs

[Daniel (daniel-redhat-bugs)]

+++ This bug was initially created as a clone of Bug #782147 +++

setroubleshoot uses the rpm python bindings and is a long running service, Each time an AVC arrives it checks on the version of selinux policy, the kernel, and potentially the version of the source program and the target program to identify which version of the package was being used. If we are hit with a storm of AVC's we are seeing the memory skyrocket. We diagnosed the problem to rpm python bindings leaking. For now we are removing the bindings and going to executing rpm -qf PATH. Not an ideal solution, but we need this fix in RHEL5 and RHEL6. As well as Fedora.

--- Additional comment from <email address hidden> on 2012-01-16 11:32:37 EST ---

Dave Malcolm, believes he has a fix for this problem.

http://lists.rpm.org/pipermail/rpm-maint/2011-December/003138.html

[Panu (panu-redhat-bugs)]

The python bindings in RHEL-5 differ significantly from those of RHEL-6, and those particular leaks are not present in RHEL-5 AFAICT (hence NOTABUG).

The bindings in RHEL-5 might well have some other leaks (the old librpm API has some unfixable leaks in itself), but those would need to be analyzed separately. Since you already have a workaround in place anyway, I dont think its worth the trouble for RHEL-5 at this point.