gh-148731: Fix crash in Element.iter() on allocation failure

timurmamedov1 · timurmamedov1 · commit 54c73d2db59c · 2026-06-24T17:03:14.000-04:00
Initialize parent_stack and parent_stack_used before the fallible
PyMem_New call so that elementiter_dealloc does not dereference
an uninitialized pointer when the allocation fails.
diff --git a/Misc/NEWS.d/next/Library/2026-06-24-12-00-00.gh-issue-148731.ElItOm.rst b/Misc/NEWS.d/next/Library/2026-06-24-12-00-00.gh-issue-148731.ElItOm.rst
@@ -0,0 +1,2 @@
+Fix crash in :meth:`xml.etree.ElementTree.Element.iter` when memory
+allocation fails during iterator construction.
diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
@@ -2368,6 +2368,9 @@ create_elementiter(elementtreestate *st, ElementObject *self, PyObject *tag,
     if (!it)
         return NULL;
 
+    it->parent_stack = NULL;
+    it->parent_stack_used = 0;
+
     it->sought_tag = Py_NewRef(tag);
     it->gettext = gettext;
     it->root_element = (ElementObject*)Py_NewRef(self);
@@ -2378,7 +2381,6 @@ create_elementiter(elementtreestate *st, ElementObject *self, PyObject *tag,
         PyErr_NoMemory();
         return NULL;
     }
-    it->parent_stack_used = 0;
     it->parent_stack_size = INIT_PARENT_STACK_SIZE;
 
     PyObject_GC_Track(it);

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fix crash in :meth:`xml.etree.ElementTree.Element.iter` when memory
	`2`	`+allocation fails during iterator construction.`