gh-125010: Fix use-after-free in AST repr()

Lib/test/test_ast/test_ast.py

@@ -1614,6 +1614,17 @@ def test_literal_eval_syntax_errors(self):
                 (\
             \ ''')
 
+    def test_literal_eval_large_input_crash(self):
+        # gh-125010: Fix use-after-free in ast repr()
+        # Note: Without setting sys.set_int_max_str_digits(0),
+        # this code throws a 'ValueError: Exceeds the limit (4300 digits)'.
+        # With sys.set_int_max_str_digits(0),
+        # this code throws a 'ValueError: malformed node or string on line 1':
+        source = "{0x0" + "e" * 250_000 + "%" + "e" * 250_000 + "1j}"
+        with self.assertRaisesRegex(ValueError,
+                                    r"Exceeds the limit \(4300 digits\)"):
+            ast.literal_eval(source)
+
     def test_bad_integer(self):
         # issue13436: Bad error message with invalid numeric values
         body = [ast.ImportFrom(module='time',

Misc/NEWS.d/next/Core_and_Builtins/2024-10-06-00-49-37.gh-issue-125010.gGlhaj.rst

@@ -0,0 +1,2 @@
+Fix a use-after-free bug in the :func:`repr` implementation of
+:class:`ast.AST` nodes.

Parser/asdl_c.py

@@ -1604,14 +1604,14 @@ def visitModule(self, mod):
             value_repr = PyObject_Repr(value);
         }
 
-        Py_DECREF(value);
-
         if (!value_repr) {
             Py_DECREF(name);
             Py_DECREF(value);
             goto error;
         }
 
+        Py_DECREF(value);
+
         if (i > 0) {
             if (_PyUnicodeWriter_WriteASCIIString(&writer, ", ", 2) < 0) {
                 Py_DECREF(name);