Possible memory leak on fail path in dictiter_iternextitem

[sergey-miryanov]

Bug report

Bug description:

Following code should decref key and value if PyTuple_New fails:

cpython/Objects/dictobject.c

Lines 5720 to 5726 in 6481539

	else {
	result = PyTuple_New(2);
	if (result == NULL)
	return NULL;
	PyTuple_SET_ITEM(result, 0, key);
	PyTuple_SET_ITEM(result, 1, value);
	}

I have PR ready.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• GH-140058: Clear key and value if PyTuple_New fails in dictiter_iternextitem #140059
• [3.14] GH-140058: Clear key and value if PyTuple_New fails in dictiter_iternextitem (GH-140059) #140107
• [3.13] GH-140058: Clear key and value if PyTuple_New fails in dictiter_iternextitem (GH-140059) #140108

[picnixz]

Aren't we actually stealing a reference and thus we should not decref key/value? In the success path, we only decref the existing item before replacing it. But I don't think we should decref it.

[sergey-miryanov]

Yes, we steal them. But if we fail, we should clear it.

[picnixz]

Why? The item still lives in the dict.

[sergey-miryanov]

dictiter_iternextitem_lock_held returns new strong references.

cpython/Objects/dictobject.c

Lines 5518 to 5524 in 6481539

	if (out_key != NULL) {
	*out_key = Py_NewRef(key);
	}
	if (out_value != NULL) {
	*out_value = Py_NewRef(value);
	}
	return 0;

[picnixz]

Oh I thought that dictiter_iternextitem_lock_held returned a borrowed ref.