In the following snippet from PyType_FromSpecWithBases() in Objects/typeobject.c, spec->name is dereferenced by strrchr() but then is checked for NULL:

    /* Set the type name and qualname */
    s = strrchr(spec->name, '.');
    if (s == NULL)
        s = (char*)spec->name;
    else
        s++;

    [snip]

    type->tp_name = spec->name;
    if (!type->tp_name)
        goto fail;

This was reported by Svace static analyzer.

If I were to check spec->name first, what error should I report to the caller? Is something like the following OK?

    if (spec->name == NULL) {
        PyErr_SetString(PyExc_SystemError,
                       "Type spec does not define the name field.");
        goto fail;
    }

Your suggested fix seems fine to me.

But if the error message is set, then for consistency, it should be also the case that the later checks set some kind of error message.

@enedil It seems that all later check either set a message or simply propagate the error set by a called function. Did you mean any specific later check?

New changeset 5f79b50763d687aeeed8edcb4efcc7ac9f8fa186 by Benjamin Peterson (Alexey Izbyshev) in branch 'master':
closes bpo-34501: PyType_FromSpecWithBases: Check spec->name before dereferencing it. (GH-8930)
https://github.com/python/cpython/commit/5f79b50763d687aeeed8edcb4efcc7ac9f8fa186

New changeset 15dadacabf6a1c62e9920b6a42ff8936ea1830f8 by Miss Islington (bot) in branch '3.7':
closes bpo-34501: PyType_FromSpecWithBases: Check spec->name before dereferencing it. (GH-8930)
https://github.com/python/cpython/commit/15dadacabf6a1c62e9920b6a42ff8936ea1830f8

New changeset 323a91bb3a2b5639637efc517fe3f30d3bc288e2 by Miss Islington (bot) in branch '3.6':
closes bpo-34501: PyType_FromSpecWithBases: Check spec->name before dereferencing it. (GH-8930)
https://github.com/python/cpython/commit/323a91bb3a2b5639637efc517fe3f30d3bc288e2