Issue #16060: Fix a double DECREF in int() implementation. Thanks Serhiy Storchaka.

diff --git a/Misc/NEWS b/Misc/NEWS
index 6922b25f2c11a413ab4d2ae3bd858f19bc48a8db..314b5a6d63a2314edb105aa64d8f8ee27ac6ce7f 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ Core and Builtins
 
 - Issue #16046: Fix loading sourceless legacy .pyo files.
 
+- Issue #16060: Fix refcounting bug when __trunc__ returns an object
+  whose __int__ gives a non-integer.  Patch by Serhiy Storchaka.
+
 Library
 -------
 

diff --git a/Objects/abstract.c b/Objects/abstract.c
index ed5e196843c09e0e13b3b3652fdb1539b1de815e..a2737dd5f4fb2910213cb822df770cc21779b376 100644 (file)
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -1228,11 +1228,10 @@ convert_integral_to_int(PyObject *integral, const char *error_format)
     nb = Py_TYPE(integral)->tp_as_number;
     if (nb->nb_int) {
         PyObject *as_int = nb->nb_int(integral);
-        Py_DECREF(integral);
-        if (!as_int)
-            return NULL;
-        if (PyLong_Check(as_int))
+        if (!as_int || PyLong_Check(as_int)) {
+            Py_DECREF(integral);
             return as_int;
+        }
         Py_DECREF(as_int);
     }
     PyErr_Format(PyExc_TypeError, error_format, Py_TYPE(integral)->tp_name);