Calling function ast.literal_eval() with large size can cause a segmentation fault in Python 3.5 -3.10. Please check the following two examples. The example 1 works as expected, while the second one triggers segmentation fault on Python 3.5,3.6,3.7,3.8,3.9,3.10. The primary difference between these two examples lay on the value of "n".


Example 1: 
========================================= 
import ast
mylist = []
n = 100000
print(ast.literal_eval("mylist"+"+mylist"*n))
==========================================

The actual output: value Error on Python 3.5,3.7,3.8,3.9,3.10, Recursive Error on Python 3.6 (as expected)



Example 2:
===================================
import ast
mylist = []
n = 1000000
print(ast.literal_eval("mylist"+"+mylist"*n))
===================================

The actual output: segmentation fault on Python 3.5 - 3.10 (not as expected)


My system information:

>> python3.10 -V
Python 3.10.0a2

>> python3.9 -V
Python 3.9.0rc1

>> python3.8 -V
Python 3.8.0

>> python3.7 -V
Python 3.7.3

>> python3.6 -V
Python 3.6.12

>> uname -v
#73~16.04.1-Ubuntu

Likely duplicate of Issue42609, Probably fixed by bpo-42609

Confirmed fixed by https://github.com/python/cpython/pull/23744:

Traceback (most recent call last):
  File "/home/sstagg/tmp/fuzztest/cpython/../test.py", line 4, in <module>
    print(ast.literal_eval("mylist"+"+mylist"*n))
  File "/home/sstagg/tmp/fuzztest/prefix/lib/python3.10/ast.py", line 62, in literal_eval
    node_or_string = parse(node_or_string.lstrip(" \t"), mode='eval')
  File "/home/sstagg/tmp/fuzztest/prefix/lib/python3.10/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
RecursionError: maximum recursion depth exceeded during compilation

I closed the following by Xinmeng as duplicates of this:
#42713 eval(...) 
#42714 compile(...)
#42715 exec(...)
#42716 ast.parse(...)

This is probably a duplicate of #42609, and should likely be closed also.

I think we really need a customer parser for ast.literal_eval(), one that doesn't have the same constraints and that can be counted on for safe evaluation of untrusted input.