GH-132417: ctypes: Fix potential Py_DECREF(NULL) in py_object handling

Lib/test/test_ctypes/test_refcounts.py

@@ -123,5 +123,22 @@ def test_finalize(self):
         script_helper.assert_python_ok("-c", script)
 
 
+class PyObjectRestypeTest(unittest.TestCase):
+    def test_restype_py_object_with_null_return(self):
+        # We need a function which returns a PyObject *, and returns NULL,
+        # without setting an exception.
+        # PyErr_Occurred is one such function (when no exception is set).
+        PyErr_Occurred = ctypes.pythonapi.PyErr_Occurred
+
+        PyErr_Occurred.argtypes = []
+        PyErr_Occurred.restype = ctypes.py_object
+
+        # At this point, there's no exception set, so PyErr_Occurred
+        # returns NULL. Given the restype is py_object, the
+        # ctypes machinery will raise a custom error.
+        with self.assertRaisesRegex(ValueError, "PyObject is NULL"):
+            PyErr_Occurred()
+
+
 if __name__ == '__main__':
     unittest.main()

Misc/NEWS.d/next/Library/2025-04-11-21-48-49.gh-issue-132417.uILGdS.rst

@@ -0,0 +1,3 @@
+Fix a ``NULL`` pointer dereference when a C function called using
+:py:mod:`ctypes` with ``restype`` :py:obj:`~ctypes.py_object` returns
+``NULL``.

Modules/_ctypes/callproc.c

@@ -1022,11 +1022,12 @@ static PyObject *GetResult(ctypes_state *st,
     if (info->getfunc && !_ctypes_simple_instance(st, restype)) {
         retval = info->getfunc(result, info->size);
         /* If restype is py_object (detected by comparing getfunc with
-           O_get), we have to call Py_DECREF because O_get has already
-           called Py_INCREF.
+           O_get), we have to call Py_XDECREF because O_get has already
+           called Py_INCREF, unless the result was NULL, in which case
+           an error is set (by the called function, or by O_get).
         */
         if (info->getfunc == _ctypes_get_fielddesc("O")->getfunc) {
-            Py_DECREF(retval);
+            Py_XDECREF(retval);
         }
     }
     else {