[New-bugs-announce] [issue31683] a stack overflow on windows in faulthandler._fatal_error()

[Oren Milman]

New submission from Oren Milman <orenmn at gmail.com>:

On my 64-bit Windows 10, the echo here would print -1073741571:
python -c "import faulthandler; faulthandler._fatal_error(b'a' * 2 ** 22)"
echo %errorlevel%

This is code c00000fd, which windbg describes as 'Stack overflow'.
This happens because Py_FatalError() (in Python/pylifecycle.c) does the following
(on Windows only):
    len = strlen(msg);

    /* Convert the message to wchar_t. This uses a simple one-to-one
    conversion, assuming that the this error message actually uses ASCII
    only. If this ceases to be true, we will have to convert. */
    buffer = alloca( (len+1) * (sizeof *buffer));
    for( i=0; i<=len; ++i)
        buffer[i] = msg[i];


Note that (IIUC) running the aforementioned cmd wouldn't cause a post-mortem
debugger to pop-up, because faulthandler_fatal_error_py()
(in Modules/faulthandler.c) first calls faulthandler_suppress_crash_report(),
and then calls Py_FatalError().

----------
components: Extension Modules
messages: 303651
nosy: Oren Milman, haypo
priority: normal
severity: normal
status: open
title: a stack overflow on windows in faulthandler._fatal_error()
type: crash
versions: Python 3.7

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue31683>
_______________________________________