From: Victor Stinner <vstinner@python.org>
Date: Mon, 15 Jun 2026 09:47:58 +0000 (+0200)
Subject: gh-146102: Fix type slot_bf_getbuffer() error handling (#151346)
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=0ec7c9d17e0eab5bad60796cad8dcf3632f571df;p=thirdparty%2FPython%2Fcpython.git

gh-146102: Fix type slot_bf_getbuffer() error handling (#151346)

Call PyBuffer_Release() if PyObject_GC_New() fails.

Fix also bytes_join(): only call Py_DECREF(item) after formatting the
error message which uses item.
---

diff --git a/Objects/stringlib/join.h b/Objects/stringlib/join.h
index deebfeadc0f4..fe460d41f670 100644
--- a/Objects/stringlib/join.h
+++ b/Objects/stringlib/join.h
@@ -72,11 +72,11 @@ STRINGLIB(bytes_join)(PyObject *sep, PyObject *iterable)
                drops the sequence's last reference to it. */
             Py_INCREF(item);
             if (PyObject_GetBuffer(item, &buffers[i], PyBUF_SIMPLE) != 0) {
-                Py_DECREF(item);
                 PyErr_Format(PyExc_TypeError,
                              "sequence item %zd: expected a bytes-like object, "
                              "%.80s found",
                              i, Py_TYPE(item)->tp_name);
+                Py_DECREF(item);
                 goto error;
             }
             Py_DECREF(item);
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 865c32f02b13..881ed58d275a 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -11332,6 +11332,7 @@ slot_bf_getbuffer(PyObject *self, Py_buffer *buffer, int flags)
 
     wrapper = PyObject_GC_New(PyBufferWrapper, &_PyBufferWrapper_Type);
     if (wrapper == NULL) {
+        PyBuffer_Release(buffer);
         goto fail;
     }
     wrapper->mv = ret;