From 72c7e46135bd09767cdaa3553a6d6e77eb6a1bfc Mon Sep 17 00:00:00 2001
From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Date: Thu, 6 Nov 2025 05:50:57 +0000
Subject: [PATCH] [3.14] gh-140939: Fix memory leak in `_PyBytes_FormatEx`
 error path (GH-140957) (cherry picked from commit
 d6c89a2df2c8b7603125883494e9058a88348f66)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
---
 Lib/test/test_bytes.py                                     | 7 +++++++
 .../2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst         | 2 ++
 Objects/bytesobject.c                                      | 4 +++-
 3 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst

diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py
index 5e57b6d0eee5ba..08119f5f769711 100644
--- a/Lib/test/test_bytes.py
+++ b/Lib/test/test_bytes.py
@@ -802,6 +802,13 @@ def __int__(self):
             with self.assertRaisesRegex(TypeError, msg):
                 operator.mod(format_bytes, value)
 
+    def test_memory_leak_gh_140939(self):
+        # gh-140939: MemoryError is raised without leaking
+        _testcapi = import_helper.import_module('_testcapi')
+        with self.assertRaises(MemoryError):
+            b = self.type2test(b'%*b')
+            b % (_testcapi.PY_SSIZE_T_MAX, b'abc')
+
     def test_imod(self):
         b = self.type2test(b'hello, %b!')
         orig = b
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst
new file mode 100644
index 00000000000000..a2921761f75556
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-11-03-17-21-38.gh-issue-140939.FVboAw.rst
@@ -0,0 +1,2 @@
+Fix memory leak when :class:`bytearray` or :class:`bytes` is formated with the
+``%*b`` format with a large width that results in a :exc:`MemoryError`.
diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 5dd1a1f09c82f1..eb13f16f67295c 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -975,8 +975,10 @@ _PyBytes_FormatEx(const char *format, Py_ssize_t format_len,
             /* 2: size preallocated for %s */
             if (alloc > 2) {
                 res = _PyBytesWriter_Prepare(&writer, res, alloc - 2);
-                if (res == NULL)
+                if (res == NULL) {
+                    Py_XDECREF(temp);
                     goto error;
+                }
             }
 #ifndef NDEBUG
             char *before = res;