From 6e49eb14ea31e356fe7855f07c456cadaf262826 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Thu, 20 Apr 2017 13:53:14 +0300
Subject: [PATCH 1/2] bpo-29802: Fix reference counting in module-level struct
 functions when pass argumens of wrong type.

---
 Lib/test/test_struct.py | 10 ++++++++++
 Misc/NEWS               |  3 +++
 Modules/_struct.c       |  1 +
 Objects/unicodeobject.c |  1 +
 4 files changed, 15 insertions(+)

diff --git a/Lib/test/test_struct.py b/Lib/test/test_struct.py
index 932ef4737852b9..02d50b2d1c374e 100644
--- a/Lib/test/test_struct.py
+++ b/Lib/test/test_struct.py
@@ -599,6 +599,16 @@ def test_boundary_error_message_with_negative_offset(self):
                 'offset -11 out of range for 10-byte buffer'):
             struct.pack_into('<B', byte_list, -11, 123)
 
+    def test_issue29802(self):
+        # When the second argument of struct.unpack() was of wrong type
+        # the Struct object was decrefed twice and the reference to
+        # deallocated object was left in a cache.
+        with self.assertRaises(TypeError):
+            struct.unpack(b'b', 0)
+        # Shouldn't crash.
+        self.assertEqual(struct.unpack(b'b', b'a'), (b'a'[0],))
+
+
 class UnpackIteratorTest(unittest.TestCase):
     """
     Tests for iterative unpacking (struct.Struct.iter_unpack).
diff --git a/Misc/NEWS b/Misc/NEWS
index 3ec02e0e3e8ef6..0ba4489ec5f038 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -313,6 +313,9 @@ Extension Modules
 Library
 -------
 
+- bpo-29802: Fixed reference counting in module-level struct functions when
+  pass argumens of wrong type.
+
 - bpo-30070: Fixed leaks and crashes in errors handling in the parser module.
 
 - bpo-22352: Column widths in the output of dis.dis() are now adjusted for
diff --git a/Modules/_struct.c b/Modules/_struct.c
index 4bc41869234fbb..a614be89d23036 100644
--- a/Modules/_struct.c
+++ b/Modules/_struct.c
@@ -2083,6 +2083,7 @@ cache_struct_converter(PyObject *fmt, PyObject **ptr)
 
     if (fmt == NULL) {
         Py_DECREF(*ptr);
+        *ptr = NULL;
         return 1;
     }
 
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index ef2215fbc3c7f3..b68042179f0903 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -3907,6 +3907,7 @@ PyUnicode_FSDecoder(PyObject* arg, void* addr)
     PyObject *output = NULL;
     if (arg == NULL) {
         Py_DECREF(*(PyObject**)addr);
+        *(PyObject**)addr = NULL;
         return 1;
     }
 

From 36d3be9abc6a4780b37fe68df891127c25f8b861 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Thu, 20 Apr 2017 20:16:11 +0300
Subject: [PATCH 2/2] Fix a typo.

---
 Misc/NEWS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Misc/NEWS b/Misc/NEWS
index 0ba4489ec5f038..f194ea9f12556a 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -314,7 +314,7 @@ Library
 -------
 
 - bpo-29802: Fixed reference counting in module-level struct functions when
-  pass argumens of wrong type.
+  pass arguments of wrong type.
 
 - bpo-30070: Fixed leaks and crashes in errors handling in the parser module.