gh-145376: Fix various reference leaks in Objects/ and Modules/ (#145385)

Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>

diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index ff0e2fd2b3569d50ee697ec9a079547c4e3b8c0a..bc25bf6bfc1bd2b4f2f3619affb67f97bd7df9af 100644 (file)
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -3531,23 +3531,26 @@ count_traverse(PyObject *op, visitproc visit, void *arg)
 static PyObject *
 count_nextlong(countobject *lz)
 {
-    PyObject *long_cnt;
-    PyObject *stepped_up;
-
-    long_cnt = lz->long_cnt;
-    if (long_cnt == NULL) {
+    if (lz->long_cnt == NULL) {
         /* Switch to slow_mode */
-        long_cnt = PyLong_FromSsize_t(PY_SSIZE_T_MAX);
-        if (long_cnt == NULL)
+        lz->long_cnt = PyLong_FromSsize_t(PY_SSIZE_T_MAX);
+        if (lz->long_cnt == NULL) {
             return NULL;
+        }
     }
-    assert(lz->cnt == PY_SSIZE_T_MAX && long_cnt != NULL);
+    assert(lz->cnt == PY_SSIZE_T_MAX && lz->long_cnt != NULL);
+
+    // We hold one reference to "result" (a.k.a. the old value of
+    // lz->long_cnt); we'll either return it or keep it in lz->long_cnt.
+    PyObject *result = lz->long_cnt;
 
-    stepped_up = PyNumber_Add(long_cnt, lz->long_step);
-    if (stepped_up == NULL)
+    PyObject *stepped_up = PyNumber_Add(result, lz->long_step);
+    if (stepped_up == NULL) {
         return NULL;
+    }
     lz->long_cnt = stepped_up;
-    return long_cnt;
+
+    return result;
 }
 
 static PyObject *

diff --git a/Objects/enumobject.c b/Objects/enumobject.c
index 814ce4f919514b92dd050f54097b2e2693c7087f..70e7cce6aba0082a1400563e49caefccf71f30d5 100644 (file)
--- a/Objects/enumobject.c
+++ b/Objects/enumobject.c
@@ -178,14 +178,16 @@ enum_traverse(PyObject *op, visitproc visit, void *arg)
 static inline PyObject *
 increment_longindex_lock_held(enumobject *en)
 {
-    PyObject *next_index = en->en_longindex;
-    if (next_index == NULL) {
-        next_index = PyLong_FromSsize_t(PY_SSIZE_T_MAX);
-        if (next_index == NULL) {
+    if (en->en_longindex == NULL) {
+        en->en_longindex = PyLong_FromSsize_t(PY_SSIZE_T_MAX);
+        if (en->en_longindex == NULL) {
             return NULL;
         }
     }
-    assert(next_index != NULL);
+    assert(en->en_longindex != NULL);
+    // We hold one reference to "next_index" (a.k.a. the old value of
+    // en->en_longindex); we'll either return it or keep it in en->en_longindex
+    PyObject *next_index = en->en_longindex;
     PyObject *stepped_up = PyNumber_Add(next_index, en->one);
     if (stepped_up == NULL) {
         return NULL;

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 3921b7cd7b69bcff2dfeaa432fe0dc370c55e0a6..7fc21907fefd314267c3794097ec723662a906fd 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -4294,7 +4294,9 @@ listiter_reduce_general(void *_it, int forward)
     }
     /* empty iterator, create an empty list */
     list = PyList_New(0);
-    if (list == NULL)
+    if (list == NULL) {
+        Py_DECREF(iter);
         return NULL;
+    }
     return Py_BuildValue("N(N)", iter, list);
 }