From 8e5d35c96edea86606b74a4baafed75a8b533e03 Mon Sep 17 00:00:00 2001 From: Timur Mamedov Date: Sun, 21 Jun 2026 14:28:57 -0400 Subject: [PATCH 1/2] gh-151815: Fix segfault in template_iter on allocation failure --- .../2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst | 2 ++ Objects/templateobject.c | 2 ++ 2 files changed, 4 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst new file mode 100644 index 000000000000000..07c53738ef04021 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-20-14-00-00.gh-issue-151815.TmplIt.rst @@ -0,0 +1,2 @@ +Fix segfault in t-string iterator deallocation when :c:func:`PyObject_GetIter` +fails during construction, caused by ``Py_CLEAR`` on uninitialized pointers. diff --git a/Objects/templateobject.c b/Objects/templateobject.c index 1609e82b444516c..994b352d7dcd639 100644 --- a/Objects/templateobject.c +++ b/Objects/templateobject.c @@ -226,6 +226,8 @@ template_iter(PyObject *op) if (iter == NULL) { return NULL; } + iter->stringsiter = NULL; + iter->interpolationsiter = NULL; PyObject *stringsiter = PyObject_GetIter(self->strings); if (stringsiter == NULL) { From 36af6ce9ad48829919be2d1506733c06fa35af38 Mon Sep 17 00:00:00 2001 From: Timur Mamedov Date: Wed, 8 Jul 2026 17:02:58 -0400 Subject: [PATCH 2/2] Create sub-iterators before allocating the iterator object --- Objects/templateobject.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/Objects/templateobject.c b/Objects/templateobject.c index 994b352d7dcd639..7d168e6fcac789e 100644 --- a/Objects/templateobject.c +++ b/Objects/templateobject.c @@ -222,26 +222,25 @@ static PyObject * template_iter(PyObject *op) { templateobject *self = templateobject_CAST(op); - templateiterobject *iter = PyObject_GC_New(templateiterobject, &_PyTemplateIter_Type); - if (iter == NULL) { - return NULL; - } - iter->stringsiter = NULL; - iter->interpolationsiter = NULL; PyObject *stringsiter = PyObject_GetIter(self->strings); if (stringsiter == NULL) { - Py_DECREF(iter); return NULL; } PyObject *interpolationsiter = PyObject_GetIter(self->interpolations); if (interpolationsiter == NULL) { - Py_DECREF(iter); Py_DECREF(stringsiter); return NULL; } + templateiterobject *iter = PyObject_GC_New(templateiterobject, &_PyTemplateIter_Type); + if (iter == NULL) { + Py_DECREF(stringsiter); + Py_DECREF(interpolationsiter); + return NULL; + } + iter->stringsiter = stringsiter; iter->interpolationsiter = interpolationsiter; iter->from_strings = 1;