gh-143544: Fix possible use-after-free in the JSON decoder when JSONDecodeError disappears during raising it

Lib/test/test_json/test_fail.py

@@ -236,5 +236,33 @@ def test_linecol(self):
                              'Expecting value: line %s column %d (char %d)' %
                              (line, col, idx))
 
+    def test_reentrant_jsondecodeerror_does_not_crash(self):
+        # gh-143544
+        import json
+
+        orig_json_error = json.JSONDecodeError
+        orig_decoder_error = json.decoder.JSONDecodeError
+
+        class Trigger:
+            def __call__(self, *args):
+                # Remove JSONDecodeError during construction to trigger re-entrancy
+                del json.JSONDecodeError
+                del json.decoder.JSONDecodeError
+                return ValueError("boom")
+
+        hook = Trigger()
+        try:
+            json.JSONDecodeError = hook
+            json.decoder.JSONDecodeError = hook
+
+            # The exact exception type is not important here;
+            # this test only ensures we don't crash.
+            with self.assertRaises(Exception):
+                json.loads('"\\uZZZZ"')
+
+        finally:
+            json.JSONDecodeError = orig_json_error
+            json.decoder.JSONDecodeError = orig_decoder_error
+
 class TestPyFail(TestFail, PyTest): pass
 class TestCFail(TestFail, CTest): pass

Modules/_json.c

@@ -415,19 +415,20 @@ raise_errmsg(const char *msg, PyObject *s, Py_ssize_t end)
 {
     /* Use JSONDecodeError exception to raise a nice looking ValueError subclass */
     _Py_DECLARE_STR(json_decoder, "json.decoder");
+
     PyObject *JSONDecodeError =
-         PyImport_ImportModuleAttr(&_Py_STR(json_decoder), &_Py_ID(JSONDecodeError));
+        PyImport_ImportModuleAttr(&_Py_STR(json_decoder), &_Py_ID(JSONDecodeError));
     if (JSONDecodeError == NULL) {
         return;
     }
 
-    PyObject *exc;
-    exc = PyObject_CallFunction(JSONDecodeError, "zOn", msg, s, end);
-    Py_DECREF(JSONDecodeError);
-    if (exc) {
+    PyObject *exc = PyObject_CallFunction(JSONDecodeError, "zOn", msg, s, end);
+    if (exc != NULL) {
         PyErr_SetObject(JSONDecodeError, exc);
         Py_DECREF(exc);
     }
+
+    Py_DECREF(JSONDecodeError);
 }
 
 static void