Issue #24103: Fixed possible use after free in ElementTree.XMLPullParser.

diff --cc Misc/NEWS
Simple merge

diff --cc Modules/_elementtree.c
index 5908c725e13928289175d36f1e778b1eae70b7e3,2856bacc4a5e4ea5d19ac66ea820cf1eeb9b9d10..f69ce2976667aabd44b11d7420fcc58353291772
--- 1/Modules/_elementtree.c
--- 2/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@@ -3578,12 -3595,12 +3578,12 @@@ static PyObject 
  _elementtree_XMLParser__setevents_impl(XMLParserObject *self,
                                         PyObject *events_queue,
                                         PyObject *events_to_report)
 -/*[clinic end generated code: output=1440092922b13ed1 input=59db9742910c6174]*/
 +/*[clinic end generated code: output=1440092922b13ed1 input=abf90830a1c3b0fc]*/
  {
      /* activate element event reporting */
-     Py_ssize_t i, seqlen;
+     Py_ssize_t i;
      TreeBuilderObject *target;
 -    PyObject *events_seq;
 +    PyObject *events_append, *events_seq;
  
      if (!TreeBuilder_CheckExact(self->target)) {
          PyErr_SetString(
@@@ -3596,11 -3613,8 +3596,10 @@@
  
      target = (TreeBuilderObject*) self->target;
  
 -    Py_INCREF(events_queue);
 -    Py_SETREF(target->events, events_queue);
 +    events_append = PyObject_GetAttrString(events_queue, "append");
 +    if (events_append == NULL)
 +        return NULL;
-     Py_XDECREF(target->events_append);
-     target->events_append = events_append;
++    Py_SETREF(target->events_append, events_append);
  
      /* clear out existing events */
      Py_CLEAR(target->start_event_obj);