gh-145376: Fix various reference leaks in Objects/ and Modules/ (#145385)

eendebakpt · blurb-it[bot] · web-flow · commit 886bc6e14bf0 · 2026-03-09T14:19:36.000+01:00
Co-authored-by: blurb-it[bot] &lt;43283697+blurb-it[bot]@users.noreply.github.com&gt;
diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
@@ -3531,23 +3531,26 @@ count_traverse(PyObject *op, visitproc visit, void *arg)
 static PyObject *
 count_nextlong(countobject *lz)
 {
-    PyObject *long_cnt;
-    PyObject *stepped_up;
-
-    long_cnt = lz->long_cnt;
-    if (long_cnt == NULL) {
+    if (lz->long_cnt == NULL) {
         /* Switch to slow_mode */
-        long_cnt = PyLong_FromSsize_t(PY_SSIZE_T_MAX);
-        if (long_cnt == NULL)
+        lz->long_cnt = PyLong_FromSsize_t(PY_SSIZE_T_MAX);
+        if (lz->long_cnt == NULL) {
             return NULL;
+        }
     }
-    assert(lz->cnt == PY_SSIZE_T_MAX && long_cnt != NULL);
+    assert(lz->cnt == PY_SSIZE_T_MAX && lz->long_cnt != NULL);
+
+    // We hold one reference to "result" (a.k.a. the old value of
+    // lz->long_cnt); we'll either return it or keep it in lz->long_cnt.
+    PyObject *result = lz->long_cnt;
 
-    stepped_up = PyNumber_Add(long_cnt, lz->long_step);
-    if (stepped_up == NULL)
+    PyObject *stepped_up = PyNumber_Add(result, lz->long_step);
+    if (stepped_up == NULL) {
         return NULL;
+    }
     lz->long_cnt = stepped_up;
-    return long_cnt;
+
+    return result;
 }
 
 static PyObject *
diff --git a/Objects/enumobject.c b/Objects/enumobject.c
@@ -178,14 +178,16 @@ enum_traverse(PyObject *op, visitproc visit, void *arg)
 static inline PyObject *
 increment_longindex_lock_held(enumobject *en)
 {
-    PyObject *next_index = en->en_longindex;
-    if (next_index == NULL) {
-        next_index = PyLong_FromSsize_t(PY_SSIZE_T_MAX);
-        if (next_index == NULL) {
+    if (en->en_longindex == NULL) {
+        en->en_longindex = PyLong_FromSsize_t(PY_SSIZE_T_MAX);
+        if (en->en_longindex == NULL) {
             return NULL;
         }
     }
-    assert(next_index != NULL);
+    assert(en->en_longindex != NULL);
+    // We hold one reference to "next_index" (a.k.a. the old value of
+    // en->en_longindex); we'll either return it or keep it in en->en_longindex
+    PyObject *next_index = en->en_longindex;
     PyObject *stepped_up = PyNumber_Add(next_index, en->one);
     if (stepped_up == NULL) {
         return NULL;
diff --git a/Objects/listobject.c b/Objects/listobject.c
@@ -4294,7 +4294,9 @@ listiter_reduce_general(void *_it, int forward)
     }
     /* empty iterator, create an empty list */
     list = PyList_New(0);
-    if (list == NULL)
+    if (list == NULL) {
+        Py_DECREF(iter);
         return NULL;
+    }
     return Py_BuildValue("N(N)", iter, list);
 }

Original file line number	Diff line number	Diff line change
`@@ -4294,7 +4294,9 @@ listiter_reduce_general(void *_it, int forward)`
`4294`	`4294`	`}`
`4295`	`4295`	`/* empty iterator, create an empty list */`
`4296`	`4296`	`list = PyList_New(0);`
`4297`		`- if (list == NULL)`
	`4297`	`+ if (list == NULL) {`
	`4298`	`+ Py_DECREF(iter);`
`4298`	`4299`	`return NULL;`
	`4300`	`+ }`
`4299`	`4301`	`return Py_BuildValue("N(N)", iter, list);`
`4300`	`4302`	`}`