Issue #22044: Fixed premature DECREF in call_tzinfo_method.

Lib/test/datetimetester.py

@@ -5,6 +5,7 @@ See http://www.zope.org/Members/fdrake/DateTimeWiki/TestCases
 
 import sys
 import pickle
+import random
 import unittest
 
 from operator import lt, le, gt, ge, eq, ne, truediv, floordiv, mod
@@ -76,8 +77,18 @@ class PicklableFixedOffset(FixedOffset):
     def __init__(self, offset=None, name=None, dstoffset=None):
         FixedOffset.__init__(self, offset, name, dstoffset)
 
+class _TZInfo(tzinfo):
+    def utcoffset(self, datetime_module):
+        return random.random()
+
 class TestTZInfo(unittest.TestCase):
 
+    def test_refcnt_crash_bug_22044(self):
+        tz1 = _TZInfo()
+        dt1 = datetime(2014, 7, 21, 11, 32, 3, 0, tz1)
+        with self.assertRaises(TypeError):
+            dt1.utcoffset()
+
     def test_non_abstractness(self):
         # In order to allow subclasses to get pickled, the C implementation
         # wasn't able to get away with having __init__ raise

Misc/ACKS

@@ -410,6 +410,7 @@ Russell Finn
 Dan Finnie
 Nils Fischbeck
 Frederik Fix
+Tom Flanagan
 Matt Fleming
 Hernán Martínez Foffani
 Artem Fokin

Misc/NEWS

@@ -30,6 +30,9 @@ Library
 - Issue #16133: The asynchat.async_chat.handle_read() method now ignores
   BlockingIOError exceptions.
 
+- Issue #22044: Fixed premature DECREF in call_tzinfo_method.
+  Patch by Tom Flanagan.
+
 - Issue #19884: readline: Disable the meta modifier key if stdout is not
   a terminal to not write the ANSI sequence "\033[1034h" into stdout. This
   sequence is used on some terminal (ex: TERM=xterm-256color") to enable

Modules/_datetimemodule.c

@@ -897,11 +897,11 @@ call_tzinfo_method(PyObject *tzinfo, char *name, PyObject *tzinfoarg)
         }
     }
     else {
-        Py_DECREF(offset);
         PyErr_Format(PyExc_TypeError,
                      "tzinfo.%s() must return None or "
                      "timedelta, not '%.200s'",
                      name, Py_TYPE(offset)->tp_name);
+        Py_DECREF(offset);
         return NULL;
     }