Reproduced on Fedora 15 with tip Python:

[meadori@motherbrain cpython]$ ./python 
Python 3.3.0a0 (default:3102951cc1ce+, Sep  1 2011, 22:19:06) 
[GCC 4.6.0 20110603 (Red Hat 4.6.0-10)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ctypes
[68588 refs]
>>> class S(ctypes.Structure):
...     _fields_ = [('x' * 10000000, ctypes.c_int)]
... 
Segmentation fault (core dumped)

Certainly the effect of some "alloca" call with a large value, then the stack overflows.

On Fri, Sep 2, 2011 at 4:26 PM, Amaury Forgeot d'Arc
<report@bugs.python.org> wrote:
>
> Amaury Forgeot d'Arc <amauryfa@gmail.com> added the comment:
>
> Certainly the effect of some "alloca" call with a large value, then the stack overflows.

Yeah, I noticed that too.  I was actually pretty surprised to see
"alloca" in there :-)

Here is a patch that replaces the 'alloca' call with 'PyMem_Malloc'.

Ping.  Any thoughts on this one?

Looks good to me.

Note that there is at least one other place where alloca() is used with potentially large values: the POINTER() function in callproc.c.
Also, PyUnicode_FromFormat could be used instead of sprintf.

> Note that there is at least one other place where alloca() is
> used with potentially large values:

Ouch!  I found three more crashers (including the one you found)
by grepping for 'alloca' in ctypes:

>>> from ctypes import *
>>> T = type('x' * 2 ** 25, (Structure,), {})
>>> p = POINTER(T)
Segmentation fault (core dumped)

>>> from ctypes import *
>>> p = POINTER('x' * 2 ** 25)
Segmentation fault (core dumped)

>>> from ctypes import *
>>> NARGS = 2 ** 20
>>> proto = CFUNCTYPE(None, *(c_int,) * NARGS)
>>> def func(*args):
...    return (1, "abc", None)
... 
>>> cb = proto(func)
>>> cb(*(1,) * NARGS)
Segmentation fault (core dumped)

I will fix those too.

I am going to open separate issues for the other crashers.

> Also, PyUnicode_FromFormat could be used instead of sprintf.

Amaury, how so?  'sprintf' and 'stgdict->format' work with 'char *'s 
where as 'PyUnicode_FromFormat' builds a unicode string object.

Unless there are any objections, I am going to commit as is.

New changeset aa3ebc2dfc15 by Meador Inge in branch '2.7':
Issue #12881: ctypes: Fix segfault with large structure field names.
http://hg.python.org/cpython/rev/aa3ebc2dfc15

New changeset d05350c14e77 by Meador Inge in branch '3.2':
Issue #12881: ctypes: Fix segfault with large structure field names.
http://hg.python.org/cpython/rev/d05350c14e77

New changeset 2eab632864f6 by Meador Inge in branch 'default':
Issue #12881: ctypes: Fix segfault with large structure field names.
http://hg.python.org/cpython/rev/2eab632864f6

Fixed.  Opened issue13096 and issue13097 for the other crashers.