In Python/sysmodule.c the function sys_update_path() uses wcscpy to copy data to a fixed size buffer. The input comes from an external source (argv[0]) and could theoretically be larger than the buffer.

Suggested solution:
Increase the buffer a bit:

    wchar_t argv0copy[sizeof(wchar_t)* (MAXPATHLEN+1)];

and use wcsncpy:

    wcsncpy(argv0copy, argv0, MAXPATHLEN);
    argv0copy[MAXPATHLEN] = L'\0';


CID 486850

search_for_prefix() and search_for_exec_prefix() contain similar code.

CID 486612
CID 486611

Here is a patch for 3.3 and tip that replaces wcscpy() with wcsncpy() and adds a proper NUL terminator at MAXPATHLEN.

> -                wcscpy(q+1, link);
> +                wcsncpy(q+1, link, MAXPATHLEN);
> +                argv0copy[2*MAXPATHLEN] = L'\0';

Should be `q[MAXPATHLEN] = L'\0';`. Otherwise there will be a bug when a length of link is MAXPATHLEN.

Good point, but I think it should be `q[MAXPATHLEN + 1] = L'\0';`.

Agree.

New changeset dca92e8a011a by Christian Heimes in branch '3.3':
Issue #15905: Fix theoretical buffer overflow in handling of sys.argv[0],
http://hg.python.org/cpython/rev/dca92e8a011a

New changeset 01597384531f by Christian Heimes in branch 'default':
Issue #15905: Fix theoretical buffer overflow in handling of sys.argv[0],
http://hg.python.org/cpython/rev/01597384531f

Thanks!