[3.11] pythongh-105375: Harden pyexpat initialisation (python#105606)

(cherry picked from commit 20a56d8)

Add proper error handling to add_errors_module() to prevent exceptions
from possibly being overwritten.

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

Misc/NEWS.d/next/Library/2023-06-09-23-00-13.gh-issue-105605.YuwqxY.rst

@@ -0,0 +1,3 @@
+Harden :mod:`pyexpat` error handling during module initialisation to prevent
+exceptions from possibly being overwritten, and objects from being
+dereferenced twice.

Modules/pyexpat.c

@@ -1768,14 +1768,18 @@ add_error(PyObject *errors_module, PyObject *codes_dict,
 static int
 add_errors_module(PyObject *mod)
 {
+ // add_submodule() returns a borrowed ref.
  PyObject *errors_module = add_submodule(mod, MODULE_NAME ".errors");
  if (errors_module == NULL) {
  return -1;
  }
 
  PyObject *codes_dict = PyDict_New();
+ if (codes_dict == NULL) {
+ return -1;
+ }
  PyObject *rev_codes_dict = PyDict_New();
- if (codes_dict == NULL || rev_codes_dict == NULL) {
+ if (rev_codes_dict == NULL) {
  goto error;
  }
 
@@ -1796,19 +1800,17 @@ add_errors_module(PyObject *mod)
  goto error;
  }
 
- Py_INCREF(codes_dict);
- if (PyModule_AddObject(errors_module, "codes", codes_dict) < 0) {
-  Py_DECREF(codes_dict);
+ int rc = PyModule_AddObjectRef(errors_module, "codes", codes_dict);
+ Py_CLEAR(codes_dict);
+ if (rc < 0) {
  goto error;
  }
- Py_CLEAR(codes_dict);
 
- Py_INCREF(rev_codes_dict);
- if (PyModule_AddObject(errors_module, "messages", rev_codes_dict) < 0) {
-  Py_DECREF(rev_codes_dict);
+ rc = PyModule_AddObjectRef(errors_module, "messages", rev_codes_dict);
+ Py_CLEAR(rev_codes_dict);
+ if (rc < 0) {
  goto error;
  }
- Py_CLEAR(rev_codes_dict);
 
  return 0;