gh-146102: Fix type slot_bf_getbuffer() error handling (#151346)

Call PyBuffer_Release() if PyObject_GC_New() fails.

Fix also bytes_join(): only call Py_DECREF(item) after formatting the
error message which uses item.

diff --git a/Objects/stringlib/join.h b/Objects/stringlib/join.h
index deebfeadc0f4fd87e4ddefc68418b6cd32063eae..fe460d41f6700f81ea7c39a0869e2f92143970dd 100644 (file)
--- a/Objects/stringlib/join.h
+++ b/Objects/stringlib/join.h
@@ -72,11 +72,11 @@ STRINGLIB(bytes_join)(PyObject *sep, PyObject *iterable)
                drops the sequence's last reference to it. */
             Py_INCREF(item);
             if (PyObject_GetBuffer(item, &buffers[i], PyBUF_SIMPLE) != 0) {
-                Py_DECREF(item);
                 PyErr_Format(PyExc_TypeError,
                              "sequence item %zd: expected a bytes-like object, "
                              "%.80s found",
                              i, Py_TYPE(item)->tp_name);
+                Py_DECREF(item);
                 goto error;
             }
             Py_DECREF(item);

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 865c32f02b13b441b6cf2f6fb9dae9c28d31f3bf..881ed58d275ac7a4e1f28ba6cf3a0e5564588eb6 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -11332,6 +11332,7 @@ slot_bf_getbuffer(PyObject *self, Py_buffer *buffer, int flags)
 
     wrapper = PyObject_GC_New(PyBufferWrapper, &_PyBufferWrapper_Type);
     if (wrapper == NULL) {
+        PyBuffer_Release(buffer);
         goto fail;
     }
     wrapper->mv = ret;