commit d6d35d0a005bb3d1e04095074c255bf8d0b651d7
author Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Fri Oct 19 00:16:25 2018 -0700
committer GitHub <noreply@github.com> Fri Oct 19 00:16:25 2018 -0700
tree bbce020047386f5d247d3c5014c800f672ff6f3a
parent 2bc1e8c909773b4721c961d45eff7f4a41425b9b

Fix several reference counting bugs in pyexpat.c. (GH-9955)

(cherry picked from commit 68def052dcd41313eff2bd9f269e22c5a941db4d)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

Modules/pyexpat.c

diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
index c52079e..ab3dac6 100644
--- a/Modules/pyexpat.c
+++ b/Modules/pyexpat.c
@@ -243,8 +243,10 @@
     if (!value) {
         if (PyDict_SetItem(self->intern, result, result) == 0)
             return result;
-        else
+        else {
+            Py_DECREF(result);
             return NULL;
+        }
     }
     Py_INCREF(value);
     Py_DECREF(result);
@@ -393,6 +395,7 @@
                 flag_error(self);
                 Py_DECREF(n);
                 Py_DECREF(v);
+                Py_DECREF(container);
                 return;
             }
             else {
@@ -401,12 +404,14 @@
             }
         }
         args = string_intern(self, name);
-        if (args != NULL)
-            args = Py_BuildValue("(NN)", args, container);
         if (args == NULL) {
             Py_DECREF(container);
             return;
         }
+        args = Py_BuildValue("(NN)", args, container);
+        if (args == NULL) {
+            return;
+        }
         /* Container is now a borrowed reference; ignore it. */
         self->in_callback = 1;
         rv = call_with_frame("StartElement", __LINE__,
@@ -565,7 +570,6 @@
         }
         args = Py_BuildValue("NN", nameobj, modelobj);
         if (args == NULL) {
-            Py_DECREF(modelobj);
             flag_error(self);
             goto finally;
         }