gh-140593: Fix a memory leak in function my_ElementDeclHandler of pyexpat

Lib/test/test_pyexpat.py

@@ -718,6 +718,24 @@ def test_expaterror(self):
             self.assertEqual(e.code,
                              errors.codes[errors.XML_ERROR_UNCLOSED_TOKEN])
 
+class ElementDeclHandlerCleanUpLeakTest(unittest.TestCase):
+
+    def test_trigger_leak(self):
+        # Unfixed, this test would leak 32 to 56 bytes of memory
+        # https://github.com/python/cpython/issues/140593
+        data = textwrap.dedent('''\
+            <!DOCTYPE quotations SYSTEM "quotations.dtd" [
+                <!ELEMENT root ANY>
+            ]>
+            <root/>
+        ''').encode('UTF-8')
+
+        parser = expat.ParserCreate()
+        parser.NotStandaloneHandler = lambda: 1.234  # arbitrary float
+        parser.ElementDeclHandler = lambda _1, _2: None
+        with self.assertRaises(TypeError):
+            parser.Parse(data, True)
+
 
 class ForeignDTDTests(unittest.TestCase):
     """

Misc/NEWS.d/next/Library/2025-10-25-21-26-16.gh-issue-140593.OxlLc9.rst

@@ -0,0 +1,3 @@
+:mod:`xml.parsers.expat`: Fix a memory leak that could affect users with
+:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler` set to a custom
+element declaration handler. Patch by Sebastian Pipping.

Modules/pyexpat.c

@@ -642,7 +642,7 @@ my_ElementDeclHandler(void *userData,
         PyObject *modelobj, *nameobj;
 
         if (PyErr_Occurred())
-            return;
+            goto finally;
 
         if (flush_character_buffer(self) < 0)
             goto finally;