gh-125010: Fix use-after-free in AST repr()

Lib/test/test_ast/test_ast.py

@@ -789,6 +789,13 @@ def test_repr(self) -> None:
             with self.subTest(test_input=test):
                 self.assertEqual(repr(ast.parse(test)), snapshot)
 
+    def test_repr_large_input_crash(self):
+        # gh-125010: Fix use-after-free in ast repr()
+        source = "0x0" + "e" * 10_000
+        with self.assertRaisesRegex(ValueError,
+                                    r"Exceeds the limit \(\d+ digits\)"):
+            repr(ast.Constant(value=eval(source)))
+
 
 class CopyTests(unittest.TestCase):
     """Test copying and pickling AST nodes."""

Misc/NEWS.d/next/Core_and_Builtins/2024-10-06-00-49-37.gh-issue-125010.gGlhaj.rst

@@ -0,0 +1,2 @@
+Fix a use-after-free bug in the :func:`repr` implementation of
+:class:`ast.AST` nodes.

Parser/asdl_c.py

@@ -1604,14 +1604,14 @@ def visitModule(self, mod):
             value_repr = PyObject_Repr(value);
         }
 
-        Py_DECREF(value);
-
         if (!value_repr) {
             Py_DECREF(name);
             Py_DECREF(value);
             goto error;
         }
 
+        Py_DECREF(value);
+
         if (i > 0) {
             if (_PyUnicodeWriter_WriteASCIIString(&writer, ", ", 2) < 0) {
                 Py_DECREF(name);