diff -r d2867c430333 Objects/unicodeobject.c
--- a/Objects/unicodeobject.c	Sat Jan 05 07:37:47 2013 +0200
+++ b/Objects/unicodeobject.c	Sun Jan 06 22:24:07 2013 +0200
@@ -3182,7 +3182,7 @@
     /* On narrow builds we split characters outside the BMP into two
        codepoints => count how much extra space we need. */
 #ifndef Py_UNICODE_WIDE
-    for (qq = q; qq < e; qq += 4)
+    for (qq = q; e - qq >= 4; qq += 4)
         if (qq[iorder[2]] != 0 || qq[iorder[3]] != 0)
             pairs++;
 #endif