diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst new file mode 100644 index 00000000000000..07c53738ef0402 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst @@ -0,0 +1,2 @@ +Fix segfault in t-string iterator deallocation when :c:func:`PyObject_GetIter` +fails during construction, caused by ``Py_CLEAR`` on uninitialized pointers. diff --git a/Objects/templateobject.c b/Objects/templateobject.c index 1609e82b444516..7d168e6fcac789 100644 --- a/Objects/templateobject.c +++ b/Objects/templateobject.c @@ -222,24 +222,25 @@ static PyObject * template_iter(PyObject *op) { templateobject *self = templateobject_CAST(op); - templateiterobject *iter = PyObject_GC_New(templateiterobject, &_PyTemplateIter_Type); - if (iter == NULL) { - return NULL; - } PyObject *stringsiter = PyObject_GetIter(self->strings); if (stringsiter == NULL) { - Py_DECREF(iter); return NULL; } PyObject *interpolationsiter = PyObject_GetIter(self->interpolations); if (interpolationsiter == NULL) { - Py_DECREF(iter); Py_DECREF(stringsiter); return NULL; } + templateiterobject *iter = PyObject_GC_New(templateiterobject, &_PyTemplateIter_Type); + if (iter == NULL) { + Py_DECREF(stringsiter); + Py_DECREF(interpolationsiter); + return NULL; + } + iter->stringsiter = stringsiter; iter->interpolationsiter = interpolationsiter; iter->from_strings = 1;