homepage

A Py_ssize_t overflow can be constructed in _PySequence_BytesToCharpArray().
Patch attached.
Demonstration (requires revision >= 2af78f8a98e1):
Python 3.3.0b2+ (default:2af78f8a98e1, Aug 20 2012, 11:38:54)
[GCC 4.4.3] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import sys, _posixsubprocess
[65851 refs]
>>> class Z(object):
... def __len__(self):
... return sys.maxsize
... def __getitem__(self, i):
... return b'x'
...
[65923 refs]
>>> _posixsubprocess.fork_exec(1,Z(),3,[1, 2],5,6,7,8,9,10,11,12,13,14,15,16,17)
Segmentation fault

It's fine if the Rietveld comments are addressed.

issue15736.diff shows what I meant in the comments. I find this
slightly more readable than casting the big RHS expression.

Sorry, the right diff this time.

Bad news: gcc-4.6.3 needs the size_t cast, otherwise it warns with
both the assert() and the (argc < 0) version.
So I suggest using the size_t cast and a comment.

New changeset dbbf3ccf72e8 by Stefan Krah in branch '3.2':
Issue #15736: Fix overflow in _PySequence_BytesToCharpArray().
http://hg.python.org/cpython/rev/dbbf3ccf72e8 

I used the cast for gcc >= 4.6 and the assert() as a courtesy to
authors of buggy sq_length() functions. Thanks for the comments!