commit dedb28efd84314d899f795e821a3fc27d2f928e7
author Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Sat Jun 30 11:25:37 2018 -0700
committer GitHub <noreply@github.com> Sat Jun 30 11:25:37 2018 -0700
tree 19568d821f293b3cd5bdcaf267b1d0ff0fc951d0
parent fd1c092bb9fee46d8d543710973c69a0e93a697a

bpo-25862: Fix several bugs in the _io module. (GH-8026)


They can be exposed when some C API calls fail due to lack of
memory.

* Failed Py_BuildValue() could cause an assertion error in the
  following TextIOWrapper.tell().
* input_chunk could be decrefed twice in TextIOWrapper.seek()
  after failed Py_BuildValue().
* initvalue could leak in StringIO.__getstate__() after failed
  PyDict_Copy().
(cherry picked from commit fdb5a50ef34f7951c3b01eb77b1359725a9ad670)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

Modules/_io/stringio.c

diff --git a/Modules/_io/stringio.c b/Modules/_io/stringio.c
index 718b1ac..460442f 100644
--- a/Modules/_io/stringio.c
+++ b/Modules/_io/stringio.c
@@ -826,8 +826,10 @@
     }
     else {
         dict = PyDict_Copy(self->dict);
-        if (dict == NULL)
+        if (dict == NULL) {
+            Py_DECREF(initvalue);
             return NULL;
+        }
     }
 
     state = Py_BuildValue("(OOnN)", initvalue,