#682 pythoncom.IsGatewayRegistered reference counting bug

[David Nelson]

There appears to be a reference counting bug in pythoncom.IsGatewayRegistered.

The function seems not to be used by pywin32 itself, and perhaps no one is using it, but the fix is simple.

The following (somewhat contrived) code causes an access violation on Windows 7 with Python 2.7.3 (32-bit and 64-bit) and pywin32 219:

Python 2.7.3 (default, Apr 10 2012, 23:24:47) [MSC v.1500 64 bit (AMD64)] on win
32
Type "help", "copyright", "credits" or "license" for more information.

import pythoncom
pythoncom.IsGatewayRegistered(pythoncom.IID_IDispatch)
1
pythoncom.WrapObject(None)

Problem signature:
Problem Event Name: BEX64
Application Name: python.exe
Application Version: 0.0.0.0
Application Timestamp: 4f84a524
Fault Module Name: StackHash_21ac
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Offset: 0000000002c6b0a0
Exception Code: c0000005
Exception Data: 0000000000000008
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033
Additional Information 1: 21ac
Additional Information 2: 21acd2946b853b72135bf345e8c1227d
Additional Information 3: 3a36
Additional Information 4: 3a36df2b6c5bfb667f5682b12cc83d0b

The behavior is similar with 32-bit python.

The problem appears to be a reference counting bug in pythoncom_IsGatewayRegistered (in com/win32com/src/Register.cpp).

...
222 v = PyDict_GetItem(
223 g_obPyCom_MapServerIIDToGateway,
224 obIID);
225 if (!v)
226 {
227 PyErr_Clear();
228 v = PyInt_FromLong(0);
229 }
230 else
231 {
232 Py_DECREF(v);
233 v = PyInt_FromLong(1);
234 }
235 return v;
...

PyDict_GetItem returns a borrowed reference, but the else path calls Py_DECREF. Also, PyDict_GetItem claims not to set an error if the key is not found, so the call to PyErr_Clear is probably not necessary.

As a workaround, one can check membership in pythoncom.ServerInterfaces.