Handle failure from PyDict_New or PyList_New

[radarhere]

Two changes here.

1. PyDict_New() and PyList_New() may return NULL. This addresses situations where that is not handled.
2. Resolves Memory leaks when function returns directly on failure without decreasing the refcnt of a new reference (static analyzer reports) #6322, by decrementing reference counts. The first change adds another situation where this is needed, so these are in the same PR.

[akx]

geterror, used for error handling elsewhere here, calls PyErr_SetString before returning NULL; maybe these should have something too instead of just returning NULL..? (Repeated for other bare return NULL;s in this PR.)

[radarhere]

My thinking was to copy behaviour is already used in Pillow in another location.

Pillow/src/_imaging.c

Lines 3819 to 3822 in 2b16494

	d = PyDict_New();
	if (!d) {
	return NULL;
	}

Looking at CPython, I think that PyList_New already sets an error before returning. The same with PyDict_New.

[akx]

Ah, great, so it seems 👍

(I'd personally probably add a comment that says something like // Error set by PyDict_New on the return line, but that's fine.)

[akx]

Feels like this duplicated cleaning code should be deduplicated, maybe..?

[radarhere]

Ok, I've pushed a commit to rearrange the code.

[hugovk]

@akx How's it look now?

[nulano]

This loop looks suspicious to me. PyList_GetItem returns a borrowed reference, so the decref will cause it to be freed. However, the list is expected to also free its contents when it's reference count is decrefed later: https://github.com/python/cpython/blob/e375bff03736f809fbc234010c087ef9d7e0d384/Objects/listobject.c#L356

So I would expect this loop to cause each list_axis to be double freed (except the last, which has not been added to the list yet).

[radarhere]

Thanks. I've applied the suggestion from @nulano, which means that the loop was de-duplicated is no longer present. So I've actually undone the rearranging of the code as it is no longer necessary.

[hugovk]

Some of these new return NULLs aren't covered by tests. I guess it's not very easy to trigger them, and that's fine as defensive programming in this case.

[hugovk]

@akx How's it look now?

[nulano]

This loop looks suspicious to me. PyList_GetItem returns a borrowed reference, so the decref will cause it to be freed. However, the list is expected to also free its contents when it's reference count is decrefed later: https://github.com/python/cpython/blob/e375bff03736f809fbc234010c087ef9d7e0d384/Objects/listobject.c#L356

So I would expect this loop to cause each list_axis to be double freed (except the last, which has not been added to the list yet).