gh-143544: Fix possible use-after-free in the JSON decoder when JSONDecodeError disappears during raising it (#143561)

VanshAgarwal24036 · picnixz · web-flow · commit c31574806014 · 2026-01-12T16:39:32.000+01:00
Co-authored-by: Bénédikt Tran &lt;10796600+picnixz@users.noreply.github.com&gt;
diff --git a/Modules/_json.c b/Modules/_json.c
@@ -423,11 +423,12 @@ raise_errmsg(const char *msg, PyObject *s, Py_ssize_t end)
 
     PyObject *exc;
     exc = PyObject_CallFunction(JSONDecodeError, "zOn", msg, s, end);
-    Py_DECREF(JSONDecodeError);
     if (exc) {
         PyErr_SetObject(JSONDecodeError, exc);
         Py_DECREF(exc);
     }
+
+    Py_DECREF(JSONDecodeError);
 }
 
 static void

Original file line number	Diff line number	Diff line change
`@@ -423,11 +423,12 @@ raise_errmsg(const char msg, PyObject s, Py_ssize_t end)`
`423`	`423`
`424`	`424`	`PyObject *exc;`
`425`	`425`	`exc = PyObject_CallFunction(JSONDecodeError, "zOn", msg, s, end);`
`426`		`- Py_DECREF(JSONDecodeError);`
`427`	`426`	`if (exc) {`
`428`	`427`	`PyErr_SetObject(JSONDecodeError, exc);`
`429`	`428`	`Py_DECREF(exc);`
`430`	`429`	`}`
	`430`	`+`
	`431`	`+ Py_DECREF(JSONDecodeError);`
`431`	`432`	`}`
`432`	`433`
`433`	`434`	`static void`