From: Peter Bierma <zintensitydev@gmail.com>
Date: Tue, 21 Oct 2025 12:10:01 +0000 (-0400)
Subject: gh-140406: Fix memory leak upon `__hash__` returning a non-integer (GH-140411)
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=71db05a12d9953a96f809d84b4d0d452a464e431;p=thirdparty%2FPython%2Fcpython.git

gh-140406: Fix memory leak upon `__hash__` returning a non-integer (GH-140411)
---

diff --git a/Lib/test/test_builtin.py b/Lib/test/test_builtin.py
index 85cfe5c90f48..034cd5f7f9e8 100644
--- a/Lib/test/test_builtin.py
+++ b/Lib/test/test_builtin.py
@@ -1184,6 +1184,16 @@ class BuiltinTest(ComplexesAreIdenticalMixin, unittest.TestCase):
                 return self
         self.assertEqual(hash(Z(42)), hash(42))
 
+    def test_invalid_hash_typeerror(self):
+        # GH-140406: The returned object from __hash__() would leak if it
+        # wasn't an integer.
+        class A:
+            def __hash__(self):
+                return 1.0
+
+        with self.assertRaises(TypeError):
+            hash(A())
+
     def test_hex(self):
         self.assertEqual(hex(16), '0x10')
         self.assertEqual(hex(-16), '-0x10')
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-10-21-06-51-50.gh-issue-140406.0gJs8M.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-10-21-06-51-50.gh-issue-140406.0gJs8M.rst
new file mode 100644
index 000000000000..3506ba42581f
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-10-21-06-51-50.gh-issue-140406.0gJs8M.rst
@@ -0,0 +1,2 @@
+Fix memory leak when an object's :meth:`~object.__hash__` method returns an
+object that isn't an :class:`int`.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 29233c1959c4..721d48712446 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -10569,6 +10569,7 @@ slot_tp_hash(PyObject *self)
         return PyObject_HashNotImplemented(self);
     }
     if (!PyLong_Check(res)) {
+        Py_DECREF(res);
         PyErr_SetString(PyExc_TypeError,
                         "__hash__ method should return an integer");
         return -1;