From 7d25b81025a50cc0368f5727c65e875ca769469a Mon Sep 17 00:00:00 2001
From: Sebastian Berg <sebastian@sipsolutions.net>
Date: Fri, 18 Jun 2021 16:49:58 -0500
Subject: [PATCH] BUG: Fix refcount leak in ResultType

This slightly reorganizes the error path handling (duplicating
the freeing for the non-error path).  It just seemed a bit clearer.
---
 numpy/core/src/multiarray/convert_datatype.c | 23 +++++++++++---------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/numpy/core/src/multiarray/convert_datatype.c b/numpy/core/src/multiarray/convert_datatype.c
index e7407535e5f7..d197a4bea31e 100644
--- a/numpy/core/src/multiarray/convert_datatype.c
+++ b/numpy/core/src/multiarray/convert_datatype.c
@@ -1649,14 +1649,14 @@ PyArray_ResultType(
         Py_DECREF(all_DTypes[i]);
     }
     if (common_dtype == NULL) {
-        goto finish;
+        goto error;
     }
 
     if (common_dtype->abstract) {
         /* (ab)use default descriptor to define a default */
         PyArray_Descr *tmp_descr = common_dtype->default_descr(common_dtype);
         if (tmp_descr == NULL) {
-            goto finish;
+            goto error;
         }
         Py_INCREF(NPY_DTYPE(tmp_descr));
         Py_SETREF(common_dtype, NPY_DTYPE(tmp_descr));
@@ -1689,20 +1689,18 @@ PyArray_ResultType(
                 PyObject *tmp = PyArray_GETITEM(
                         arrs[i-ndtypes], PyArray_BYTES(arrs[i-ndtypes]));
                 if (tmp == NULL) {
-                    Py_SETREF(result, NULL);
-                    goto finish;
+                    goto error;
                 }
                 curr = common_dtype->discover_descr_from_pyobject(common_dtype, tmp);
                 Py_DECREF(tmp);
             }
             if (curr == NULL) {
-                Py_SETREF(result, NULL);
-                goto finish;
+                goto error;
             }
             Py_SETREF(result, common_dtype->common_instance(result, curr));
             Py_DECREF(curr);
             if (result == NULL) {
-                goto finish;
+                goto error;
             }
         }
     }
@@ -1723,16 +1721,21 @@ PyArray_ResultType(
              * Going from error to success should not really happen, but is
              * probably OK if it does.
              */
-            Py_SETREF(result, NULL);
-            goto finish;
+            goto error;
         }
         /* Return the old "legacy" result (could warn here if different) */
         Py_SETREF(result, legacy_result);
     }
 
-  finish:
+    Py_DECREF(common_dtype);
     PyMem_Free(info_on_heap);
     return result;
+
+  error:
+    Py_XDECREF(result);
+    Py_XDECREF(common_dtype);
+    PyMem_Free(info_on_heap);
+    return NULL;
 }