I'm getting a couple of compiler warnings with gcc-10.1.1 (Fedora 32) with an asan and ubsan build:

Parser/string_parser.c: In function ‘decode_unicode_with_escapes’:
Parser/string_parser.c:100:17: warning: null destination pointer [-Wformat-overflow=]
  100 |                 sprintf(p, "\\U%08x", chr);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~
Parser/string_parser.c:100:17: warning: null destination pointer [-Wformat-overflow=]
Parser/string_parser.c:100:17: warning: null destination pointer [-Wformat-overflow=]

Objects/unicodeobject.c: In function ‘xmlcharrefreplace’:
Objects/unicodeobject.c:849:16: warning: null destination pointer [-Wformat-overflow=]
  849 |         str += sprintf(str, "&#%d;", PyUnicode_READ(kind, data, i));
      |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Objects/unicodeobject.c:849:16: warning: null destination pointer [-Wformat-overflow=]
Objects/unicodeobject.c:849:16: warning: null destination pointer [-Wformat-overflow=]

In function ‘assemble_lnotab’,
    inlined from ‘assemble_emit’ at Python/compile.c:5697:25,
    inlined from ‘assemble’ at Python/compile.c:6036:18:
Python/compile.c:5651:19: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=]
 5651 |         *lnotab++ = k;
      |         ~~~~~~~~~~^~~

I *think* the lnotab one is the compiler failing to detect that the pointer has been updated to point inside the body of a Python object, but I'm also not 100% sure that it's a false alarm.