Fix bug #1517, a possible segfault in lookup().

diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index af0d6f37aef860ac167e8c73a804bd6cac7fe88b..a315446301cff2e1f5a1ad7fd0f8188784da02a7 100644 (file)
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -272,7 +272,9 @@ lookdict(dictobject *mp, PyObject *key, register long hash)
        else {
                if (ep->me_hash == hash) {
                        startkey = ep->me_key;
+                        Py_INCREF(startkey);
                        cmp = PyObject_RichCompareBool(startkey, key, Py_EQ);
+                        Py_DECREF(startkey);
                        if (cmp < 0)
                                return NULL;
                        if (ep0 == mp->ma_table && ep->me_key == startkey) {
@@ -302,7 +304,9 @@ lookdict(dictobject *mp, PyObject *key, register long hash)
                        return ep;
                if (ep->me_hash == hash && ep->me_key != dummy) {
                        startkey = ep->me_key;
+                        Py_INCREF(startkey);
                        cmp = PyObject_RichCompareBool(startkey, key, Py_EQ);
+                        Py_DECREF(startkey);
                        if (cmp < 0)
                                return NULL;
                        if (ep0 == mp->ma_table && ep->me_key == startkey) {