[3.14] gh-140406: Fix memory leak upon `__hash__` returning a non-integer (GH-140411...

gh-140406: Fix memory leak upon `__hash__` returning a non-integer (GH-140411)
(cherry picked from commit 71db05a12d9953a96f809d84b4d0d452a464e431)

Co-authored-by: Peter Bierma <zintensitydev@gmail.com>

diff --git a/Lib/test/test_builtin.py b/Lib/test/test_builtin.py
index 8830641f0abdc79048665f2308d7fa7a8a81d32f..413429f51096c51333458d6241d0ed6129e06cbb 100644 (file)
--- a/Lib/test/test_builtin.py
+++ b/Lib/test/test_builtin.py
@@ -1183,6 +1183,16 @@ class BuiltinTest(ComplexesAreIdenticalMixin, unittest.TestCase):
                 return self
         self.assertEqual(hash(Z(42)), hash(42))
 
+    def test_invalid_hash_typeerror(self):
+        # GH-140406: The returned object from __hash__() would leak if it
+        # wasn't an integer.
+        class A:
+            def __hash__(self):
+                return 1.0
+
+        with self.assertRaises(TypeError):
+            hash(A())
+
     def test_hex(self):
         self.assertEqual(hex(16), '0x10')
         self.assertEqual(hex(-16), '-0x10')

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-10-21-06-51-50.gh-issue-140406.0gJs8M.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-10-21-06-51-50.gh-issue-140406.0gJs8M.rst
new file mode 100644 (file)
index 0000000..3506ba4
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-10-21-06-51-50.gh-issue-140406.0gJs8M.rst
@@ -0,0 +1,2 @@
+Fix memory leak when an object's :meth:`~object.__hash__` method returns an
+object that isn't an :class:`int`.

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 28451fee7ec10f4a1ab756ab29240d05ca8d1ab3..954547eb4fb7b06043b26f44b54ab7aa09601879 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -10195,6 +10195,7 @@ slot_tp_hash(PyObject *self)
         return PyObject_HashNotImplemented(self);
     }
     if (!PyLong_Check(res)) {
+        Py_DECREF(res);
         PyErr_SetString(PyExc_TypeError,
                         "__hash__ method should return an integer");
         return -1;