Fixed reference/memory leaks in decode_definite_long_string (#290)

Two reference/memory leaks in the C extension's long string decoder:

1. Missing Py_DECREF(ret) before reassignment after PyUnicode_Concat,
   leaking all intermediate Unicode objects during chunked decoding.

2. Missing PyMem_Free(buffer) on the success path, leaking the scratch
   buffer used for UTF-8 boundary handling.

Author: killiancowan82

docs/versionhistory.rst

@@ -20,6 +20,8 @@ This library adheres to `Semantic Versioning 2.0 <http://semver.org/>`_.
   (`#254 <https://github.com/agronholm/cbor2/issues/254>`_)
 - Fixed a missed check for an exception in the C implementation of ``CBOREncoder.encode_shared()``
   (`#287 <https://github.com/agronholm/cbor2/issues/287>`_)
+- Fixed two reference/memory leaks in the C extension's long string decoder
+  (`#290 <https://github.com/agronholm/cbor2/pull/290>`_ PR by @killiancowan82)
 
 **5.8.0** (2025-12-30)
 

scripts/ref_leak_test.py

@@ -85,6 +85,8 @@ class Module:
     ),
     ("tag", {}, c_cbor2.CBORTag(1, 1)),
     ("nestedtag", {}, {c_cbor2.CBORTag(1, 1): 1}),
+    ("longstr_128k", {}, "x" * 131072),
+    ("longstr_multi_utf8", {}, ("a" * 65535 + "€") * 2),
 ]
 
 Leaks = namedtuple("Leaks", ("count", "comparison"))
@@ -105,7 +107,7 @@ def test_malloc(op):
     # NOTE: Filter pointing to the op() line in the loop below, because we're
     # only interested in memory allocated by that line. Naturally, if this file
     # is edited, the lineno parameter below must be adjusted!
-    only_op = tracemalloc.Filter(True, __file__, lineno=102, all_frames=True)
+    only_op = tracemalloc.Filter(True, __file__, lineno=119, all_frames=True)
     tracemalloc.start(10)
     try:
         # Perform a pre-run of op so that any one-time memory allocation

source/decoder.c

@@ -937,6 +937,7 @@ decode_definite_long_string(CBORDecoderObject *self, Py_ssize_t length)
 
             Py_DECREF(string);
             string = NULL;
+            Py_DECREF(ret);
             ret = joined;
         } else {
             // Set the result to the decoded string
@@ -969,6 +970,9 @@ decode_definite_long_string(CBORDecoderObject *self, Py_ssize_t length)
     if (ret && string_namespace_add(self, ret, length) == -1)
         goto error;
 
+    if (buffer)
+        PyMem_Free(buffer);
+
     return ret;
 error:
     Py_XDECREF(ret);