SF patch 703666: Several objects don't decref tmp on failure in subtype_new

Submitted By: Christopher A. Craig

Fillin some missing decrefs.

4 files changed, 13 insertions, 4 deletions

diff --git a/Objects/floatobject.c b/Objects/floatobject.c
index f36479f..9ed53e2 100644
--- a/Objects/floatobject.c
+++ b/Objects/floatobject.c
@@ -751,8 +751,10 @@ float_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 		return NULL;
 	assert(PyFloat_CheckExact(tmp));
 	new = type->tp_alloc(type, 0);
-	if (new == NULL)
+	if (new == NULL) {
+		Py_DECREF(tmp);
 		return NULL;
+	}
 	((PyFloatObject *)new)->ob_fval = ((PyFloatObject *)tmp)->ob_fval;
 	Py_DECREF(tmp);
 	return new;
diff --git a/Objects/intobject.c b/Objects/intobject.c
index 4b5dc55..a3df3ba 100644
--- a/Objects/intobject.c
+++ b/Objects/intobject.c
@@ -958,8 +958,10 @@ int_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 	}
 
 	new = type->tp_alloc(type, 0);
-	if (new == NULL)
+	if (new == NULL) {
+		Py_DECREF(tmp);
 		return NULL;
+	}
 	((PyIntObject *)new)->ob_ival = ival;
 	Py_DECREF(tmp);
 	return new;
diff --git a/Objects/longobject.c b/Objects/longobject.c
index 52c30c2..f246bd2 100644
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -2794,8 +2794,10 @@ long_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 	if (n < 0)
 		n = -n;
 	new = (PyLongObject *)type->tp_alloc(type, n);
-	if (new == NULL)
+	if (new == NULL) {
+		Py_DECREF(tmp);
 		return NULL;
+	}
 	assert(PyLong_Check(new));
 	new->ob_size = tmp->ob_size;
 	for (i = 0; i < n; i++)
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 94c67c8..af427dd 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -6688,12 +6688,15 @@ unicode_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 		return NULL;
 	assert(PyUnicode_Check(tmp));
 	pnew = (PyUnicodeObject *) type->tp_alloc(type, n = tmp->length);
-	if (pnew == NULL)
+	if (pnew == NULL) {
+		Py_DECREF(tmp);
 		return NULL;
+	}
 	pnew->str = PyMem_NEW(Py_UNICODE, n+1);
 	if (pnew->str == NULL) {
 		_Py_ForgetReference((PyObject *)pnew);
 		PyObject_Del(pnew);
+		Py_DECREF(tmp);
 		return PyErr_NoMemory();
 	}
 	Py_UNICODE_COPY(pnew->str, tmp->str, n+1);