Found this in test_codecs running under Valgrind (Python 3.3):


test_bug1251300 (test.test_codecs.UnicodeInternalTest) ... ==11511== Invalid read of size 1
==11511==    at 0x44AF37: _PyUnicode_DecodeUnicodeInternal (unicodeobject.c:6133)
==11511==    by 0x4DEB5C: unicode_internal_decode (_codecsmodule.c:251)
==11511==    by 0x5093F6: PyObject_Call (abstract.c:2082)
==11511==    by 0x47D7F2: PyEval_CallObjectWithKeywords (ceval.c:3942)
==11511==    by 0x491C38: PyCodec_Decode (codecs.c:403)
==11511==    by 0x459D7D: PyUnicode_Decode (unicodeobject.c:3129)
==11511==    by 0x45A287: PyUnicode_FromEncodedObject (unicodeobject.c:3023)
==11511==    by 0x519A45: bytes_decode (bytesobject.c:2320)
==11511==    by 0x484AB8: PyEval_EvalFrameEx (ceval.c:4374)
==11511==    by 0x485ACB: PyEval_EvalFrameEx (ceval.c:4150)
==11511==    by 0x486779: PyEval_EvalCodeEx (ceval.c:3433)
==11511==    by 0x4859CA: PyEval_EvalFrameEx (ceval.c:4160)
==11511==  Address 0x984a7e2 is 0 bytes after a block of size 34 alloc'd
==11511==    at 0x4C27972: realloc (vg_replace_malloc.c:525)
==11511==    by 0x51AC34: _PyBytes_Resize (bytesobject.c:2881)
==11511==    by 0x51B1FA: PyBytes_FromObject (bytesobject.c:2732)
==11511==    by 0x51C134: bytes_new (bytesobject.c:2594)
==11511==    by 0x42A4E4: type_call (typeobject.c:723)
==11511==    by 0x5093F6: PyObject_Call (abstract.c:2082)
==11511==    by 0x4843D5: PyEval_EvalFrameEx (ceval.c:4282)
==11511==    by 0x485ACB: PyEval_EvalFrameEx (ceval.c:4150)
==11511==    by 0x486779: PyEval_EvalCodeEx (ceval.c:3433)
==11511==    by 0x4859CA: PyEval_EvalFrameEx (ceval.c:4160)
==11511==    by 0x486779: PyEval_EvalCodeEx (ceval.c:3433)
==11511==    by 0x538EF8: function_call (funcobject.c:633)
==11511== 



_PyUnicode_DecodeUnicodeInternal (s=0x984a7e0 "", size=<value optimized out>, errors=0x0)
    at Objects/unicodeobject.c:6133
6133            ((char *) &uch)[2] = s[2];




==================================================================




==11511== 
==11511== Debugger has detached.  Valgrind regains control.  We continue.
==11511== Invalid read of size 1
==11511==    at 0x44AF3E: _PyUnicode_DecodeUnicodeInternal (unicodeobject.c:6134)
==11511==    by 0x4DEB5C: unicode_internal_decode (_codecsmodule.c:251)
==11511==    by 0x5093F6: PyObject_Call (abstract.c:2082)
==11511==    by 0x47D7F2: PyEval_CallObjectWithKeywords (ceval.c:3942)
==11511==    by 0x491C38: PyCodec_Decode (codecs.c:403)
==11511==    by 0x459D7D: PyUnicode_Decode (unicodeobject.c:3129)
==11511==    by 0x45A287: PyUnicode_FromEncodedObject (unicodeobject.c:3023)
==11511==    by 0x519A45: bytes_decode (bytesobject.c:2320)
==11511==    by 0x484AB8: PyEval_EvalFrameEx (ceval.c:4374)
==11511==    by 0x485ACB: PyEval_EvalFrameEx (ceval.c:4150)
==11511==    by 0x486779: PyEval_EvalCodeEx (ceval.c:3433)
==11511==    by 0x4859CA: PyEval_EvalFrameEx (ceval.c:4160)
==11511==  Address 0x984a7e3 is 1 bytes after a block of size 34 alloc'd
==11511==    at 0x4C27972: realloc (vg_replace_malloc.c:525)
==11511==    by 0x51AC34: _PyBytes_Resize (bytesobject.c:2881)
==11511==    by 0x51B1FA: PyBytes_FromObject (bytesobject.c:2732)
==11511==    by 0x51C134: bytes_new (bytesobject.c:2594)
==11511==    by 0x42A4E4: type_call (typeobject.c:723)
==11511==    by 0x5093F6: PyObject_Call (abstract.c:2082)
==11511==    by 0x4843D5: PyEval_EvalFrameEx (ceval.c:4282)
==11511==    by 0x485ACB: PyEval_EvalFrameEx (ceval.c:4150)
==11511==    by 0x486779: PyEval_EvalCodeEx (ceval.c:3433)
==11511==    by 0x4859CA: PyEval_EvalFrameEx (ceval.c:4160)
==11511==    by 0x486779: PyEval_EvalCodeEx (ceval.c:3433)
==11511==    by 0x538EF8: function_call (funcobject.c:633)
==11511== 


Loaded symbols for /usr/lib/gconv/ISO8859-9.so
_PyUnicode_DecodeUnicodeInternal (s=0x8295790 "", size=<value optimized out>, errors=0x0)
    at Objects/unicodeobject.c:6134
6134            ((char *) &uch)[3] = s[3];