merge 3.4 (#22849)

3 files changed, 19 insertions, 1 deletions

diff --git a/Lib/test/test_io.py b/Lib/test/test_io.py
index a3567fa..746f59b 100644
--- a/Lib/test/test_io.py
+++ b/Lib/test/test_io.py
@@ -2856,6 +2856,22 @@ class TextIOWrapperTest(unittest.TestCase):
 
         self.assertEqual(t.read(200), bytes_val.decode('utf-8'))
 
+    def test_issue22849(self):
+        class F(object):
+            def readable(self): return True
+            def writable(self): return True
+            def seekable(self): return True
+
+        for i in range(10):
+            try:
+                self.TextIOWrapper(F(), encoding='utf-8')
+            except Exception:
+                pass
+
+        F.tell = lambda x: 0
+        t = self.TextIOWrapper(F(), encoding='utf-8')
+
+
 class MemviewBytesIO(io.BytesIO):
     '''A BytesIO object whose read method returns memoryviews
        rather than bytes'''
diff --git a/Misc/NEWS b/Misc/NEWS
index 1c72d96..ef98134 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -188,6 +188,8 @@ Library
 
 - Issue #22578: Added attributes to the re.error class.
 
+- Issue #22849: Fix possible double free in the io.TextIOWrapper constructor.
+
 - Issue #12728: Different Unicode characters having the same uppercase but
   different lowercase are now matched in case-insensitive regular expressions.
 
diff --git a/Modules/_io/textio.c b/Modules/_io/textio.c
index 177e0f3..0f53b0f 100644
--- a/Modules/_io/textio.c
+++ b/Modules/_io/textio.c
@@ -1061,7 +1061,7 @@ textiowrapper_init(textio *self, PyObject *args, PyObject *kwds)
     }
 
     /* Finished sorting out the codec details */
-    Py_DECREF(codec_info);
+    Py_CLEAR(codec_info);
 
     self->buffer = buffer;
     Py_INCREF(buffer);