Issue #13018: Fix reference leaks in error paths in dictobject.c.

Patch by Suman Saha.

diff --git a/Misc/NEWS b/Misc/NEWS
index c078623d3b4ca0a39d3fef4867af92a5b9593bc0..115ff696a6bea1678a72e081c4805aa06eb7721e 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.2.3?
 Core and Builtins
 -----------------
 
+- Issue #13018: Fix reference leaks in error paths in dictobject.c.
+  Patch by Suman Saha.
+
 - Issue #1294232: In a few cases involving metaclass inheritance, the
   interpreter would sometimes invoke the wrong metaclass when building a new
   class object. These cases now behave correctly. Patch by Daniel Urban.

diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index 3fa5cc4b95bbe1274ee8e3b613858c6a64644884..79894e56049781dc239149d4ac251d51a6679bb4 100644 (file)
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -1314,14 +1314,18 @@ dict_fromkeys(PyObject *cls, PyObject *args)
         PyObject *key;
         Py_hash_t hash;
 
-        if (dictresize(mp, Py_SIZE(seq)))
+        if (dictresize(mp, Py_SIZE(seq))) {
+            Py_DECREF(d);
             return NULL;
+        }
 
         while (_PyDict_Next(seq, &pos, &key, &oldvalue, &hash)) {
             Py_INCREF(key);
             Py_INCREF(value);
-            if (insertdict(mp, key, hash, value))
+            if (insertdict(mp, key, hash, value)) {
+                Py_DECREF(d);
                 return NULL;
+            }
         }
         return d;
     }
@@ -1332,14 +1336,18 @@ dict_fromkeys(PyObject *cls, PyObject *args)
         PyObject *key;
         Py_hash_t hash;
 
-        if (dictresize(mp, PySet_GET_SIZE(seq)))
+        if (dictresize(mp, PySet_GET_SIZE(seq))) {
+            Py_DECREF(d);
             return NULL;
+        }
 
         while (_PySet_NextEntry(seq, &pos, &key, &hash)) {
             Py_INCREF(key);
             Py_INCREF(value);
-            if (insertdict(mp, key, hash, value))
+            if (insertdict(mp, key, hash, value)) {
+                Py_DECREF(d);
                 return NULL;
+            }
         }
         return d;
     }