@@ -0,0 +1,3 @@
+Fix a crash in the :term:`free-threaded build` where :c:func:`PyList_New` could leave
+a newly allocated list's item buffer pointer uninitialized when the backing
+array allocation failed under low memory, leading to an invalid free.
@@ -267,10 +267,11 @@ PyList_New(Py_ssize_t size)
             return NULL;
         }
     }
-    if (size <= 0) {
-        op->ob_item = NULL;
-    }
-    else {
+    op->ob_item = NULL;
+    op->allocated = 0;
+    Py_SET_SIZE(op, size);
+
+    if (size > 0) {
 #ifdef Py_GIL_DISABLED
         _PyListArray *array = list_allocate_array(size);
         if (array == NULL) {
@@ -287,7 +288,7 @@ PyList_New(Py_ssize_t size)
             return PyErr_NoMemory();
         }
     }
-    Py_SET_SIZE(op, size);
+
     op->allocated = size;
     _PyObject_GC_TRACK(op);
     return (PyObject *) op;
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+Fix a crash in the :term:`free-threaded build` where :c:func:`PyList_New` could leave
	`2`	`+a newly allocated list's item buffer pointer uninitialized when the backing`
	`3`	`+array allocation failed under low memory, leading to an invalid free.`
Original file line number	Diff line number	Diff line change
`@@ -267,10 +267,11 @@ PyList_New(Py_ssize_t size)`
`267`	`267`	`return NULL;`
`268`	`268`	`}`
`269`	`269`	`}`
`270`		`- if (size <= 0) {`
`271`		`- op->ob_item = NULL;`
`272`		`- }`
`273`		`- else {`
	`270`	`+ op->ob_item = NULL;`
	`271`	`+ op->allocated = 0;`
	`272`	`+ Py_SET_SIZE(op, size);`
	`273`	`+`
	`274`	`+ if (size > 0) {`
`274`	`275`	`#ifdef Py_GIL_DISABLED`
`275`	`276`	`_PyListArray *array = list_allocate_array(size);`
`276`	`277`	`if (array == NULL) {`
`@@ -287,7 +288,7 @@ PyList_New(Py_ssize_t size)`
`287`	`288`	`return PyErr_NoMemory();`
`288`	`289`	`}`
`289`	`290`	`}`
`290`		`- Py_SET_SIZE(op, size);`
	`291`	`+`
`291`	`292`	`op->allocated = size;`
`292`	`293`	`_PyObject_GC_TRACK(op);`
`293`	`294`	`return (PyObject *) op;`