[Numpy-tickets] [NumPy] #939: Reference counting bug in PyArray_TakeFrom in exceptional case

[NumPy]

#939: Reference counting bug in PyArray_TakeFrom in exceptional case
------------------------+---------------------------------------------------
 Reporter:  mdroe       |       Owner:  somebody
     Type:  defect      |      Status:  new     
 Priority:  normal      |   Milestone:          
Component:  numpy.core  |     Version:  none    
 Severity:  normal      |    Keywords:          
------------------------+---------------------------------------------------
 When calling .take() with an "out" kwarg and PyArray_TakeFrom throws an
 exception because the indices array is not convertible to PyArray_INTP,
 the "out" object is incorrectly decref'd, causing a segfault in the Python
 garbage collector upon exit.

 I have attached a script to reproduce this error, and a proposed patch.
 The patch Py_XINCREFs "out" before going to the cleanup "fail" section of
 PyArray_TakeFrom, since "fail" assumes an extra reference count.  An
 alternative is to add a second goto statement below the
 PyArray_XDECREF_ERR(ret) and go there instead.

 Initially reported in matplotlib tracker by Dav Clark here:

 https://sourceforge.net/tracker/index.php?func=detail&aid=2173204&group_id=80706&atid=560720

-- 
Ticket URL: <http://scipy.org/scipy/numpy/ticket/939>
NumPy <http://projects.scipy.org/scipy/numpy>
The fundamental package needed for scientific computing with Python.