Fix bug #1517, a segfault in lookdict().

diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index bfb891c75552bbe5721077b1a39c6e954f68a015..cd1338aed3e020ab643113a38f223f9794c3cd4a 100644 (file)
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -270,7 +270,9 @@ lookdict(PyDictObject *mp, PyObject *key, register long hash)
        else {
                if (ep->me_hash == hash) {
                        startkey = ep->me_key;
+                        Py_INCREF(startkey);
                        cmp = PyObject_RichCompareBool(startkey, key, Py_EQ);
+                        Py_DECREF(startkey);
                        if (cmp < 0)
                                return NULL;
                        if (ep0 == mp->ma_table && ep->me_key == startkey) {
@@ -300,7 +302,9 @@ lookdict(PyDictObject *mp, PyObject *key, register long hash)
                        return ep;
                if (ep->me_hash == hash && ep->me_key != dummy) {
                        startkey = ep->me_key;
+                        Py_INCREF(startkey);
                        cmp = PyObject_RichCompareBool(startkey, key, Py_EQ);
+                        Py_DECREF(startkey);
                        if (cmp < 0)
                                return NULL;
                        if (ep0 == mp->ma_table && ep->me_key == startkey) {