gh-143544: Fix use-after-free in _json.raise_errmsg

Lib/test/test_json/test_fail.py

@@ -1,4 +1,5 @@
 from test.test_json import PyTest, CTest
+import json
 
 # 2007-10-05
 JSONDOCS = [
@@ -236,5 +237,36 @@ def test_linecol(self):
                              'Expecting value: line %s column %d (char %d)' %
                              (line, col, idx))
 
+
+    def test_reentrant_jsondecodeerror_does_not_crash(self):
+        # gh-143544
+
+        class Trigger:
+            def __call__(self, *args, **kwargs):
+                # Remove JSONDecodeError during construction to trigger re-entrancy
+                del json.JSONDecodeError
+                del json.decoder.JSONDecodeError
+                return ValueError("boom")
+
+        hook = Trigger()
+
+        orig_json_error = json.JSONDecodeError
+        orig_decoder_error = json.decoder.JSONDecodeError
+
+        try:
+            # NOTE: Do not use swap_attr() here.
+            # swap_attr() keeps the replacement object alive for the duration of
+            # the context manager, which prevents the crash this test is meant
+            # to reproduce
+            json.JSONDecodeError = hook
+            json.decoder.JSONDecodeError = hook
+            del hook
+
+            with self.assertRaises(ValueError):
+                json.loads('"\\uZZZZ"')
+        finally:
+            json.JSONDecodeError = orig_json_error
+            json.decoder.JSONDecodeError = orig_decoder_error
+
 class TestPyFail(TestFail, PyTest): pass
 class TestCFail(TestFail, CTest): pass

Modules/_json.c

@@ -423,11 +423,12 @@ raise_errmsg(const char *msg, PyObject *s, Py_ssize_t end)
 
     PyObject *exc;
     exc = PyObject_CallFunction(JSONDecodeError, "zOn", msg, s, end);
-    Py_DECREF(JSONDecodeError);
     if (exc) {
         PyErr_SetObject(JSONDecodeError, exc);
         Py_DECREF(exc);
     }
+
+    Py_DECREF(JSONDecodeError);
 }
 
 static void