gh-148731: Fix Element.iter() crash on OOM

Lib/test/test_xml_etree_c.py

@@ -2,7 +2,7 @@
 import io
 import struct
 from test import support
-from test.support.import_helper import import_fresh_module
+from test.support.import_helper import import_fresh_module, import_module
 import types
 import unittest
 
@@ -15,6 +15,10 @@
 
 @unittest.skipUnless(cET, 'requires _elementtree')
 class MiscTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.testcapi = import_module('_testcapi')
+
     # Issue #8651.
     @support.bigmemtest(size=support._2G + 100, memuse=1, dry_run=False)
     def test_length_overflow(self, size):
@@ -183,6 +187,23 @@ def __hash__(self):
         r = e.get(X())
         self.assertIsNone(r)
 
+    @unittest.skipIf(support.Py_TRACE_REFS,
+                     'Py_TRACE_REFS conflicts with testcapi.set_nomemory')
+    def test_iter_oom_no_crash(self):
+        # gh-148731: OOM while creating an Element iterator should raise
+        # MemoryError without crashing while deallocating a partially
+        # initialized iterator object.
+        element = cET.Element('root')
+        raised = False
+        self.testcapi.set_nomemory(1, 2)
+        try:
+            element.iter()
+        except MemoryError:
+            raised = True
+        finally:
+            self.testcapi.remove_mem_hooks()
+        self.assertTrue(raised, "MemoryError not raised")
+
     @support.cpython_only
     def test_immutable_types(self):
         root = cET.fromstring('<a></a>')

Misc/NEWS.d/next/Library/2026-04-21-22-30-06.gh-issue-148731.imNLch.rst

@@ -0,0 +1,3 @@
+Fix a crash in :mod:`xml.etree.ElementTree` when
+:meth:`~xml.etree.ElementTree.Element.iter` fails with :exc:`MemoryError`
+while creating the C accelerator iterator.

Modules/_elementtree.c

@@ -2359,6 +2359,13 @@ create_elementiter(elementtreestate *st, ElementObject *self, PyObject *tag,
     if (!it)
         return NULL;
 
+    it->parent_stack = NULL;
+    it->parent_stack_used = 0;
+    it->parent_stack_size = 0;
+    it->root_element = NULL;
+    it->sought_tag = NULL;
+    it->gettext = 0;
+
     it->sought_tag = Py_NewRef(tag);
     it->gettext = gettext;
     it->root_element = (ElementObject*)Py_NewRef(self);