- Collector #1436: applied patch to fix a memory leak in 
       cAccessControl. 

doc/CHANGES.txt

@@ -129,6 +129,9 @@ Zope Changes
 
     Bugs fixed
 
+     - Collector #1436: applied patch to fix a memory leak in 
+       cAccessControl. 
+
      - Collector #1431: fixed NetBSD support in initgroups.c
 
      - Collector #1406: fixed segmentation fault by acquisition

lib/python/AccessControl/cAccessControl.c

@@ -1228,8 +1228,10 @@ static PyObject *ZopeSecurityPolicy_validate(PyObject *self, PyObject *args) {
                     }
                     goto err;
                   }
-                else 
+                else {
+                  Py_DECREF(eo);
                   Py_DECREF(proxy_roles);
+                }
 	} /* End of stack check */
 
 	/*| try:

lib/python/AccessControl/tests/testZopeSecurityPolicy.py

@@ -221,6 +221,17 @@ class ZopeSecurityPolicyTests (unittest.TestCase):
         self.assertPolicyAllows(item, 'setuid_m')
         self.assertPolicyAllows(item, 'dangerous_m')
 
+    def testIdentityProxy(self):
+        eo = ImplictAcqObject()
+        eo.getOwner = lambda: None
+        self.context.stack.append(eo)
+        rc = sys.getrefcount(eo)
+        self.testUserAccess()
+        self.assertEqual(rc, sys.getrefcount(eo))
+        eo._proxy_roles = ()
+        self.testUserAccess()
+        self.assertEqual(rc, sys.getrefcount(eo))
+
     def testAccessToUnprotectedSubobjects(self):
         item = self.item
         r_item = self.a.r_item