[3.9] gh-120384: gh-120298: Fix array-out-of-bounds & use after free `list` (GH-121345) (GH-140834)

(cherry picked from commit 8334a1b55c93068f5d243852029baa83377ff6c9)
(cherry picked from commit 0cd888b8d3a47428097571dddf5a0b5de37084e0)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>