Fix subtle bug in cleanup code in PyErr_NormalizeException(), detected

by Marc Lemburg.  There's a path through the code where *val is NULL,
but value isn't, and value should be DECREF'ed.

diff --git a/Python/errors.c b/Python/errors.c
index 2a45f0390a03c08cc33cbdc3afc65aae01c49b1c..1a643c0facbe2b9fe2abaf395c7c1b4a27391be0 100644 (file)
--- a/Python/errors.c
+++ b/Python/errors.c
@@ -219,8 +219,8 @@ PyErr_NormalizeException(exc, val, tb)
        *val = value;
        return;
 finally:
-       Py_DECREF(*exc);
-       Py_DECREF(*val);
+       Py_DECREF(type);
+       Py_DECREF(value);
        Py_XDECREF(*tb);
        PyErr_Fetch(exc, val, tb);
        /* normalize recursively */