gh-148395: Add regression tests for decompressor UAF after MemoryError

The CVE-2026-6100 fix (next_in = NULL on error) already landed. Add
nomemtest coverage for bz2, lzma and zlib._ZlibDecompressor so a
regression cannot silently return.

Author: Vamsi-klu

Lib/test/test_bz2.py

@@ -1060,6 +1060,29 @@ def test_uninitialized_BZ2Decompressor_crash(self):
         self.assertEqual(BZ2Decompressor.__new__(BZ2Decompressor).
                          decompress(bytes()), b'')
 
+    @support.nomemtest
+    def test_decompress_memoryerror_no_dangling_input(self):
+        # gh-148395 / CVE-2026-6100: after MemoryError in decompress(), the
+        # decompressor must not keep a dangling pointer into the input buffer.
+        import _testcapi
+        data = bz2.compress(b'x' * 4096)
+        for start in range(0, 40):
+            d = bz2.BZ2Decompressor()
+            try:
+                _testcapi.set_nomemory(start, start + 1)
+                try:
+                    d.decompress(bytearray(data), max_length=0)
+                except MemoryError:
+                    pass
+            finally:
+                _testcapi.remove_mem_hooks()
+            try:
+                out = d.decompress(bytearray(data))
+            except (MemoryError, ValueError, EOFError, OSError):
+                continue
+            self.assertIsInstance(out, bytes)
+            self.assertNotIn(b'\x00' * 64, out)
+
 
 class CompressDecompressTest(BaseTest):
     def testCompress(self):

Lib/test/test_lzma.py

@@ -383,6 +383,29 @@ def test_uninitialized_LZMADecompressor_crash(self):
         self.assertEqual(LZMADecompressor.__new__(LZMADecompressor).
                          decompress(bytes()), b'')
 
+    @support.nomemtest
+    def test_decompress_memoryerror_no_dangling_input(self):
+        # gh-148395 / CVE-2026-6100: after MemoryError in decompress(), the
+        # decompressor must not keep a dangling pointer into the input buffer.
+        import _testcapi
+        data = lzma.compress(b'x' * 4096)
+        for start in range(0, 40):
+            d = lzma.LZMADecompressor()
+            try:
+                _testcapi.set_nomemory(start, start + 1)
+                try:
+                    d.decompress(bytearray(data), max_length=0)
+                except MemoryError:
+                    pass
+            finally:
+                _testcapi.remove_mem_hooks()
+            try:
+                out = d.decompress(bytearray(data))
+            except (MemoryError, ValueError, EOFError, OSError, LZMAError):
+                continue
+            self.assertIsInstance(out, bytes)
+            self.assertNotIn(b'\x00' * 64, out)
+
     def test_riscv_filter_constant_exists(self):
         self.assertTrue(lzma.FILTER_RISCV)
 

Lib/test/test_zlib.py

@@ -1216,6 +1216,31 @@ def test_refleaks_in___init__(self):
             zlibd.__init__()
         self.assertAlmostEqual(gettotalrefcount() - refs_before, 0, delta=10)
 
+    @support.nomemtest
+    @unittest.skipUnless(hasattr(zlib, '_ZlibDecompressor'),
+                         'requires zlib._ZlibDecompressor')
+    def test_decompress_memoryerror_no_dangling_input(self):
+        # gh-148395 / CVE-2026-6100: after MemoryError in decompress(), the
+        # decompressor must not keep a dangling pointer into the input buffer.
+        import _testcapi
+        data = zlib.compress(b'x' * 4096)
+        for start in range(0, 40):
+            d = zlib._ZlibDecompressor()
+            try:
+                _testcapi.set_nomemory(start, start + 1)
+                try:
+                    d.decompress(bytearray(data), max_length=0)
+                except MemoryError:
+                    pass
+            finally:
+                _testcapi.remove_mem_hooks()
+            try:
+                out = d.decompress(bytearray(data))
+            except (MemoryError, ValueError, EOFError, OSError, zlib.error):
+                continue
+            self.assertIsInstance(out, bytes)
+            self.assertNotIn(b'\x00' * 64, out)
+
 
 class CustomInt:
     def __index__(self):