GH-49917: [Python] Remove Py_XDECREF to avoid Use-After-Free on PyList_SetItem in SparseCSFTensorToNdarray

[wr-web]

Rationale for this change

Py_DECREF(item) in PyList_SetItem will cause Use-After-Free bug if PyList_SetItem(indptr.obj(), i, item) < 0 is true, cause PyList_SetItem always steals a reference to the item, even when it fails.

What changes are included in this PR?

1. Remove Py_DECREF(item) in PyList_SetItem error path.

Are these changes tested?

By CI.

Are there any user-facing changes?

No.

• GitHub Issue: [Python] numpy_convert memory management（Use-After-Free） Bugs for PyList_SetItem in SparseCSFTensorToNdarray #49917

[github-actions]

Thanks for opening a pull request!

If this is not a minor PR. Could you open an issue for this pull request on GitHub? https://github.com/apache/arrow/issues/new/choose

Opening GitHub issues ahead of time contributes to the Openness of the Apache Arrow project.

Then could you also rename the pull request title in the following format?

GH-${GITHUB_ISSUE_ID}: [${COMPONENT}] ${SUMMARY}

or

MINOR: [${COMPONENT}] ${SUMMARY}

See also:

• Other pull requests
• Contribution Guidelines - Contributing Overview

[raulcd]

Thanks for the PR. Can you use the PR description template instead of removing it?
Can you also use the expected title for the PR as described on the automated message?

[pitrou]

(PR contents look good otherwise: PyList_SetItem always steals a reference to the item, even when it fails)

[wr-web]

Thanks for the PR. Can you use the PR description template instead of removing it? Can you also use the expected title for the PR as described on the automated message?

Done

[github-actions]

⚠️ GitHub issue #49917has been automatically assigned in GitHub to PR creator.

[raulcd]

Thank you very much for the PR!
I've done a minor update to the title so our automated tools don't trip.

[conbench-apache-arrow]

After merging your PR, Conbench analyzed the 0 benchmarking runs that have been run so far on merge-commit 15c2a3b.

None of the specified runs were found on the Conbench server.

The full Conbench report has more details.

[conbench-apache-arrow]

After merging your PR, Conbench analyzed the 3 benchmarking runs that have been run so far on merge-commit 15c2a3b.

There were no benchmark performance regressions. 🎉

The full Conbench report has more details. It also includes information about 1 possible false positive for unstable benchmarks that are known to sometimes produce them.