Use-after-free in `unicode_escape` decoder with error handler

[sethmlarson]

Crash report

What happened?

When using .decode("unicode_escape") with an error handler there is a use-after-free segfault.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler #129648
• [3.14] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) #133942
• [3.13] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) #133944
• [3.12] Fix use-after-free in the unicode-escape decoder with error handler (GH-133767) #134255
• [3.12] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) #134337
• [3.11] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) #134341
• [3.10] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) #134345
• [3.9] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) #134346