SF patch 703666: Several objects don't decref tmp on failure in subtype_new

Submitted By: Christopher A. Craig

Fillin some missing decrefs.

Objects/floatobject.c

@@ -751,8 +751,10 @@ float_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 		return NULL;
 	assert(PyFloat_CheckExact(tmp));
 	new = type->tp_alloc(type, 0);
-	if (new == NULL)
+	if (new == NULL) {
+		Py_DECREF(tmp);
 		return NULL;
+	}
 	((PyFloatObject *)new)->ob_fval = ((PyFloatObject *)tmp)->ob_fval;
 	Py_DECREF(tmp);
 	return new;

Objects/intobject.c

@@ -958,8 +958,10 @@ int_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 	}
 
 	new = type->tp_alloc(type, 0);
-	if (new == NULL)
+	if (new == NULL) {
+		Py_DECREF(tmp);
 		return NULL;
+	}
 	((PyIntObject *)new)->ob_ival = ival;
 	Py_DECREF(tmp);
 	return new;

Objects/longobject.c

@@ -2794,8 +2794,10 @@ long_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 	if (n < 0)
 		n = -n;
 	new = (PyLongObject *)type->tp_alloc(type, n);
-	if (new == NULL)
+	if (new == NULL) {
+		Py_DECREF(tmp);
 		return NULL;
+	}
 	assert(PyLong_Check(new));
 	new->ob_size = tmp->ob_size;
 	for (i = 0; i < n; i++)

Objects/unicodeobject.c

@@ -6688,12 +6688,15 @@ unicode_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 		return NULL;
 	assert(PyUnicode_Check(tmp));
 	pnew = (PyUnicodeObject *) type->tp_alloc(type, n = tmp->length);
-	if (pnew == NULL)
+	if (pnew == NULL) {
+		Py_DECREF(tmp);
 		return NULL;
+	}
 	pnew->str = PyMem_NEW(Py_UNICODE, n+1);
 	if (pnew->str == NULL) {
 		_Py_ForgetReference((PyObject *)pnew);
 		PyObject_Del(pnew);
+		Py_DECREF(tmp);
 		return PyErr_NoMemory();
 	}
 	Py_UNICODE_COPY(pnew->str, tmp->str, n+1);