From f708b0349b6076faa284134279781f7ddeacb139 Mon Sep 17 00:00:00 2001 From: Pieter Eendebak Date: Sun, 1 Mar 2026 10:37:26 +0100 Subject: [PATCH 1/9] Fix reference leak in listiter_reduce_general --- Objects/listobject.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Objects/listobject.c b/Objects/listobject.c index 4a98c8e54ab03f..527b970af24bb2 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -4270,7 +4270,9 @@ listiter_reduce_general(void *_it, int forward) } /* empty iterator, create an empty list */ list = PyList_New(0); - if (list == NULL) + if (list == NULL) { + Py_DECREF(iter); return NULL; + } return Py_BuildValue("N(N)", iter, list); } From 551a741da5a0dfaf196dfaf51573597ac5cb095c Mon Sep 17 00:00:00 2001 From: Pieter Eendebak Date: Sun, 1 Mar 2026 10:39:20 +0100 Subject: [PATCH 2/9] Fix reference leak in increment_longindex_lock_held --- Objects/enumobject.c | 1 + 1 file changed, 1 insertion(+) diff --git a/Objects/enumobject.c b/Objects/enumobject.c index 814ce4f919514b..d812d83bb8156d 100644 --- a/Objects/enumobject.c +++ b/Objects/enumobject.c @@ -188,6 +188,7 @@ increment_longindex_lock_held(enumobject *en) assert(next_index != NULL); PyObject *stepped_up = PyNumber_Add(next_index, en->one); if (stepped_up == NULL) { + Py_DECREF(next_index); return NULL; } en->en_longindex = stepped_up; From 7015ae6ccb2d290edf8e92972249bb79a91e214c Mon Sep 17 00:00:00 2001 From: Pieter Eendebak Date: Sun, 1 Mar 2026 11:02:49 +0100 Subject: [PATCH 3/9] fix reference leak in count_nextlong --- Modules/itertoolsmodule.c | 1 + 1 file changed, 1 insertion(+) diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c index ff0e2fd2b3569d..9c8dc012ad81ff 100644 --- a/Modules/itertoolsmodule.c +++ b/Modules/itertoolsmodule.c @@ -3538,6 +3538,7 @@ count_nextlong(countobject *lz) if (long_cnt == NULL) { /* Switch to slow_mode */ long_cnt = PyLong_FromSsize_t(PY_SSIZE_T_MAX); + lz->long_cnt = long_cnt; if (long_cnt == NULL) return NULL; } From c02d2dbf960d020232c8c43f6d65f54bec6da003 Mon Sep 17 00:00:00 2001 From: Pieter Eendebak Date: Sun, 1 Mar 2026 11:08:11 +0100 Subject: [PATCH 4/9] fix reference leak in count_nextlong --- Modules/itertoolsmodule.c | 5 +++-- Objects/enumobject.c | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c index 9c8dc012ad81ff..50e93c348afed5 100644 --- a/Modules/itertoolsmodule.c +++ b/Modules/itertoolsmodule.c @@ -3538,9 +3538,10 @@ count_nextlong(countobject *lz) if (long_cnt == NULL) { /* Switch to slow_mode */ long_cnt = PyLong_FromSsize_t(PY_SSIZE_T_MAX); - lz->long_cnt = long_cnt; - if (long_cnt == NULL) + if (long_cnt == NULL) { return NULL; + } + lz->long_cnt = long_cnt; } assert(lz->cnt == PY_SSIZE_T_MAX && long_cnt != NULL); diff --git a/Objects/enumobject.c b/Objects/enumobject.c index d812d83bb8156d..8feb074f66a0cd 100644 --- a/Objects/enumobject.c +++ b/Objects/enumobject.c @@ -184,11 +184,11 @@ increment_longindex_lock_held(enumobject *en) if (next_index == NULL) { return NULL; } + en->en_longindex = next_index; } assert(next_index != NULL); PyObject *stepped_up = PyNumber_Add(next_index, en->one); if (stepped_up == NULL) { - Py_DECREF(next_index); return NULL; } en->en_longindex = stepped_up; From ff7709c256794e9b89fb43c19d3bdb2377f82101 Mon Sep 17 00:00:00 2001 From: "blurb-it[bot]" <43283697+blurb-it[bot]@users.noreply.github.com> Date: Sun, 1 Mar 2026 10:15:13 +0000 Subject: [PATCH 5/9] =?UTF-8?q?=F0=9F=93=9C=F0=9F=A4=96=20Added=20by=20blu?= =?UTF-8?q?rb=5Fit.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst | 1 + 1 file changed, 1 insertion(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst new file mode 100644 index 00000000000000..a5a6908757e458 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst @@ -0,0 +1 @@ +Fix reference leaks in various unusual error scenarios. From edf016be4b02667816b3e35f7450044e6958e36f Mon Sep 17 00:00:00 2001 From: Pieter Eendebak Date: Thu, 5 Mar 2026 12:57:28 +0100 Subject: [PATCH 6/9] review comments --- Modules/itertoolsmodule.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c index 50e93c348afed5..bc25bf6bfc1bd2 100644 --- a/Modules/itertoolsmodule.c +++ b/Modules/itertoolsmodule.c @@ -3531,25 +3531,26 @@ count_traverse(PyObject *op, visitproc visit, void *arg) static PyObject * count_nextlong(countobject *lz) { - PyObject *long_cnt; - PyObject *stepped_up; - - long_cnt = lz->long_cnt; - if (long_cnt == NULL) { + if (lz->long_cnt == NULL) { /* Switch to slow_mode */ - long_cnt = PyLong_FromSsize_t(PY_SSIZE_T_MAX); - if (long_cnt == NULL) { + lz->long_cnt = PyLong_FromSsize_t(PY_SSIZE_T_MAX); + if (lz->long_cnt == NULL) { return NULL; } - lz->long_cnt = long_cnt; } - assert(lz->cnt == PY_SSIZE_T_MAX && long_cnt != NULL); + assert(lz->cnt == PY_SSIZE_T_MAX && lz->long_cnt != NULL); + + // We hold one reference to "result" (a.k.a. the old value of + // lz->long_cnt); we'll either return it or keep it in lz->long_cnt. + PyObject *result = lz->long_cnt; - stepped_up = PyNumber_Add(long_cnt, lz->long_step); - if (stepped_up == NULL) + PyObject *stepped_up = PyNumber_Add(result, lz->long_step); + if (stepped_up == NULL) { return NULL; + } lz->long_cnt = stepped_up; - return long_cnt; + + return result; } static PyObject * From 17f87992af046366cb1ba4ae0513b68fb4dd2ef7 Mon Sep 17 00:00:00 2001 From: Pieter Eendebak Date: Thu, 5 Mar 2026 12:58:02 +0100 Subject: [PATCH 7/9] remove news entry --- .../2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst | 1 - 1 file changed, 1 deletion(-) delete mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst deleted file mode 100644 index a5a6908757e458..00000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-01-10-15-06.gh-issue-145376.lG5u1a.rst +++ /dev/null @@ -1 +0,0 @@ -Fix reference leaks in various unusual error scenarios. From a7c44973eb917f9d30773f3a49748ec5101ec926 Mon Sep 17 00:00:00 2001 From: Pieter Eendebak Date: Thu, 5 Mar 2026 21:31:41 +0100 Subject: [PATCH 8/9] review comments --- Objects/enumobject.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/Objects/enumobject.c b/Objects/enumobject.c index 8feb074f66a0cd..c6ecbb5c56b003 100644 --- a/Objects/enumobject.c +++ b/Objects/enumobject.c @@ -178,15 +178,16 @@ enum_traverse(PyObject *op, visitproc visit, void *arg) static inline PyObject * increment_longindex_lock_held(enumobject *en) { - PyObject *next_index = en->en_longindex; - if (next_index == NULL) { - next_index = PyLong_FromSsize_t(PY_SSIZE_T_MAX); - if (next_index == NULL) { + if (en->en_longindex == NULL) { + en->en_longindex = PyLong_FromSsize_t(PY_SSIZE_T_MAX); + if (en->en_longindex == NULL) { return NULL; } - en->en_longindex = next_index; } assert(next_index != NULL); + // We hold one reference to "next_index" (a.k.a. the old value of + // en->en_longindex); we'll either return it or keep it in en->en_longindex + PyObject *next_index = en->en_longindex; PyObject *stepped_up = PyNumber_Add(next_index, en->one); if (stepped_up == NULL) { return NULL; From 14b2e7f3d864ea97c35ea8cb7a39de8af7991a0d Mon Sep 17 00:00:00 2001 From: Pieter Eendebak Date: Fri, 6 Mar 2026 19:43:35 +0100 Subject: [PATCH 9/9] Apply suggestion from @eendebakpt --- Objects/enumobject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Objects/enumobject.c b/Objects/enumobject.c index c6ecbb5c56b003..70e7cce6aba008 100644 --- a/Objects/enumobject.c +++ b/Objects/enumobject.c @@ -184,7 +184,7 @@ increment_longindex_lock_held(enumobject *en) return NULL; } } - assert(next_index != NULL); + assert(en->en_longindex != NULL); // We hold one reference to "next_index" (a.k.a. the old value of // en->en_longindex); we'll either return it or keep it in en->en_longindex PyObject *next_index = en->en_longindex;