From 663ceaf82231c433ada5850869e0c61a87bf9935 Mon Sep 17 00:00:00 2001 From: Jelle Zijlstra Date: Mon, 19 Oct 2026 12:34:30 -0700 Subject: [PATCH] gh-159739: Release tuple items if resizing fails Release the references still held by the original tuple when reallocation fails. Backport to 3.15 and 3.14. --- .../C_API/2026-10-19-19-33-35.gh-issue-159739.dee9a0.rst | 1 + Objects/tupleobject.c | 5 +++++ 2 files changed, 6 insertions(+) create mode 100644 Misc/NEWS.d/next/C_API/2026-10-19-19-33-35.gh-issue-159739.dee9a0.rst diff --git a/Misc/NEWS.d/next/C_API/2026-10-19-19-33-35.gh-issue-159739.dee9a0.rst b/Misc/NEWS.d/next/C_API/2026-10-19-19-33-35.gh-issue-159739.dee9a0.rst new file mode 100644 index 00000000000000..891cf551730af2 --- /dev/null +++ b/Misc/NEWS.d/next/C_API/2026-10-19-19-33-35.gh-issue-159739.dee9a0.rst @@ -0,0 +1 @@ +Fix a reference leak when :c:func:`_PyTuple_Resize` fails. diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c index 599ffad4f7b102..d7523e31779971 100644 --- a/Objects/tupleobject.c +++ b/Objects/tupleobject.c @@ -1066,6 +1066,11 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize) #ifdef Py_REF_DEBUG _Py_DecRefTotal(_PyThreadState_GET()); #endif + /* The failed reallocation leaves the original items owned by v. */ + i = oldsize; + while (--i >= 0) { + Py_XDECREF(v->ob_item[i]); + } PyObject_GC_Del(v); return -1; }