Patch is good, but while we're at it, is there any reason why this multi-allocation design was even used? It PyMem_Mallocs a buffer, makes a C-style string in it, then uses PyUnicode_FromString to convert C-style string to Python str.

Seems like the correct approach would be to just use PyUnicode_New to preallocate the final string buffer up front, then pull out the internal buffer with PyUnicode_1BYTE_DATA and populate that directly, saving a pointless allocation/deallocation, which also means the failure case means no cleanup needed at all, while barely changing the code (aside from removing the need to explicitly NUL terminate).

Only reason I can see to avoid this would be if the codec names could contain arbitrary Unicode encoded as UTF-8 (and therefore strlen wouldn't tell you the final length in Unicode ordinals), but I'm pretty sure that's not the case (if it is, we're not normalizing properly, since we only lower case ASCII). If Unicode codec names need to be handled, there are other options, though the easy savings go away.

> Only reason I can see to avoid this would be if the codec names could contain arbitrary Unicode encoded as UTF-8 (and therefore strlen wouldn't tell you the final length in Unicode ordinals), but I'm pretty sure that's not the case (if it is, we're not normalizing properly, since we only lower case ASCII). If Unicode codec names need to be handled, there are other options, though the easy savings go away.

Maybe, we can add "encoding name must be ascii" restriction in future version (3.8+).
But for now, I want to avoid any potential backward incompatibility.

New changeset 0c1c4563a65ac451021d927058e4f25013934eb2 by INADA Naoki in branch 'master':
bpo-33231: Fix potential leak in normalizestring() (GH-6386)
https://github.com/python/cpython/commit/0c1c4563a65ac451021d927058e4f25013934eb2

New changeset 64421d9237e33725e3c2916cdf2b6d6da1751c2a by Miss Islington (bot) in branch '3.7':
bpo-33231: Fix potential leak in normalizestring() (GH-6386)
https://github.com/python/cpython/commit/64421d9237e33725e3c2916cdf2b6d6da1751c2a

New changeset 2350a4765265158072bf7ad9f04402406d3d1ada by Miss Islington (bot) in branch '3.6':
bpo-33231: Fix potential leak in normalizestring() (GH-6386)
https://github.com/python/cpython/commit/2350a4765265158072bf7ad9f04402406d3d1ada