gh-143544: Fix use-after-free in _json.raise_errmsg

VanshAgarwal24036 · VanshAgarwal24036 · commit b2383451c5e3 · 2026-01-09T17:30:27.000+05:30
diff --git a/Modules/_json.c b/Modules/_json.c
@@ -417,20 +417,23 @@ raise_errmsg(const char *msg, PyObject *s, Py_ssize_t end)
     _Py_DECLARE_STR(json_decoder, "json.decoder");
 
     PyObject *JSONDecodeError =
-        PyImport_ImportModuleAttr(&_Py_STR(json_decoder), &_Py_ID(JSONDecodeError));
+        PyImport_ImportModuleAttr(&_Py_STR(json_decoder),
+                                  &_Py_ID(JSONDecodeError));
     if (JSONDecodeError == NULL) {
         return;
     }
 
     PyObject *exc = PyObject_CallFunction(JSONDecodeError, "zOn", msg, s, end);
-    if (exc != NULL) {
+    if (exc) {
         PyErr_SetObject(JSONDecodeError, exc);
         Py_DECREF(exc);
     }
 
+    /* Move DECREF after PyErr_SetObject */
     Py_DECREF(JSONDecodeError);
 }
 
+
 static void
 raise_stop_iteration(Py_ssize_t idx)
 {

Original file line number	Diff line number	Diff line change
`@@ -417,20 +417,23 @@ raise_errmsg(const char msg, PyObject s, Py_ssize_t end)`
`417`	`417`	`_Py_DECLARE_STR(json_decoder, "json.decoder");`
`418`	`418`
`419`	`419`	`PyObject *JSONDecodeError =`
`420`		`- PyImport_ImportModuleAttr(&_Py_STR(json_decoder), &_Py_ID(JSONDecodeError));`
	`420`	`+ PyImport_ImportModuleAttr(&_Py_STR(json_decoder),`
	`421`	`+ &_Py_ID(JSONDecodeError));`
`421`	`422`	`if (JSONDecodeError == NULL) {`
`422`	`423`	`return;`
`423`	`424`	`}`
`424`	`425`
`425`	`426`	`PyObject *exc = PyObject_CallFunction(JSONDecodeError, "zOn", msg, s, end);`
`426`		`- if (exc != NULL) {`
	`427`	`+ if (exc) {`
`427`	`428`	`PyErr_SetObject(JSONDecodeError, exc);`
`428`	`429`	`Py_DECREF(exc);`
`429`	`430`	`}`
`430`	`431`
	`432`	`+ /* Move DECREF after PyErr_SetObject */`
`431`	`433`	`Py_DECREF(JSONDecodeError);`
`432`	`434`	`}`
`433`	`435`
	`436`	`+`
`434`	`437`	`static void`
`435`	`438`	`raise_stop_iteration(Py_ssize_t idx)`
`436`	`439`	`{`