gh-152682: Fix NULL dereference on OOM in symtable_visit_type_param_bound_or_default

In symtable_visit_type_param_bound_or_default(), when a reserved name
(e.g. __classdict__) is used as a type parameter, PyUnicode_FromFormat()
is called to build the SyntaxError message. If the allocation fails and
returns NULL, the subsequent PyErr_SetObject() and Py_DECREF() calls
would dereference NULL, causing a segfault.

Fix by returning 0 immediately when PyUnicode_FromFormat() returns NULL.
This propagates the MemoryError set by PyUnicode_FromFormat().

The bug was introduced in gh-128632 (commit 891c61c).

Author: petrvaganoff

Lib/test/test_syntax.py

@@ -2857,10 +2857,12 @@ def f(x: *b)
 
 import re
 import doctest
+import signal
 import textwrap
 import unittest
 
 from test import support
+from test.support.script_helper import assert_python_failure
 
 class SyntaxWarningTest(unittest.TestCase):
     def check_warning(self, code, errtext, filename="<testcase>", mode="exec"):
@@ -3201,6 +3203,21 @@ class A:
     class B[{name}]: pass
                 """, "<testcase>", mode="exec")
 
+    @support.nomemtest
+    def test_disallowed_type_param_names_oom(self):
+        # gh-152682: Don't crash on OOM when formatting the SyntaxError message
+        # in symtable_visit_type_param_bound_or_default.
+        code = textwrap.dedent("""\
+            import _testcapi
+            _testcapi.set_nomemory(0)
+            compile("class A[__classdict__]: pass", "<string>", "exec")
+        """)
+        rc, _, _ = assert_python_failure("-c", code)
+        if support.MS_WINDOWS:
+            self.assertNotEqual(rc, 0xC0000005)  # STATUS_ACCESS_VIOLATION
+        else:
+            self.assertNotEqual(rc, -int(signal.SIGSEGV))
+
     @support.cpython_only
     def test_nested_named_except_blocks(self):
         code = ""

Misc/NEWS.d/next/Core_and_Builtins/2026-06-30-14-00-00.gh-issue-152682.yId7e5.rst

@@ -0,0 +1,3 @@
+Fix NULL pointer dereference in :func:`compile` when a reserved name (e.g.
+``__classdict__``) is used as a type parameter name and memory allocation
+fails while formatting the error message.

Python/symtable.c

@@ -2678,6 +2678,9 @@ symtable_visit_type_param_bound_or_default(
 
         PyObject *error_msg = PyUnicode_FromFormat("reserved name '%U' cannot be "
                                                    "used for type parameter", name);
+        if (error_msg == NULL) {
+            return 0;
+        }
         PyErr_SetObject(PyExc_SyntaxError, error_msg);
         Py_DECREF(error_msg);
         SET_ERROR_LOCATION(st->st_filename, LOCATION(tp));