GH-81061: Fix refcount issue when returning None from a ctypes.py_object callback

Lib/test/test_ctypes/test_refcounts.py

@@ -97,5 +97,31 @@ def func(a, b):
         f(1, 2)
         self.assertEqual(sys.getrefcount(ctypes.c_int), a)
 
+    @support.refcount_test
+    def test_callback_py_object_none_return(self):
+        """Test that returning ``None`` from a ``py_object`` callback
+        does not affect ``None``'s refcount (bpo-36880)."""
+
+        import sys
+
+        for FUNCTYPE in (ctypes.CFUNCTYPE, ctypes.PYFUNCTYPE):
+            with self.subTest(FUNCTYPE=FUNCTYPE):
+                proto = FUNCTYPE(ctypes.py_object)
+                @proto
+                def func():
+                    return None
+
+                # Check that calling func does not affect None's refcount.
+                none_refcount = sys.getrefcount(None)
+                # Because None's refcount can also change for other reasons,
+                # we call func in a loop to ensure that any effects on None's
+                # refcount are clearly visible.
+                for _ in range(10000):
+                    func()
+                # Allow for small variations in None's refcount from other
+                # sources.
+                self.assertAlmostEqual(
+                    sys.getrefcount(None), none_refcount, delta=50)
+
 if __name__ == '__main__':
     unittest.main()

Misc/NEWS.d/next/Library/2019-05-13-11-37-30.bpo-36880.ZgBgH0.rst

@@ -0,0 +1,2 @@
+Fix a reference counting issue when a :mod:`ctypes` callback with return
+type :class:`~ctypes.py_object` returns ``None``, which could cause crashes.

Modules/_ctypes/callbacks.c

@@ -275,15 +275,14 @@ static void _CallPythonObject(void *mem,
                                       "of ctypes callback function",
                                       callable);
         }
-        else if (keep == Py_None) {
-            /* Nothing to keep */
-            Py_DECREF(keep);
-        }
         else if (setfunc != _ctypes_get_fielddesc("O")->setfunc) {
-            if (-1 == PyErr_WarnEx(PyExc_RuntimeWarning,
-                                   "memory leak in callback function.",
-                                   1))
-            {
+            if (keep == Py_None) {
+                /* Nothing to keep */
+                Py_DECREF(keep);
+            }
+            else if (PyErr_WarnEx(PyExc_RuntimeWarning,
+                                  "memory leak in callback function.",
+                                  1) == -1) {
                 _PyErr_WriteUnraisableMsg("on converting result "
                                           "of ctypes callback function",
                                           callable);