>     char *_rtpypath = Py_GETENV("PYTHONPATH"); /* XXX use wide version on Windows */

Python now copies the env var. In master, Modules/main.c:

int res = config_get_env_var_dup(&path, L"PYTHONPATH", "PYTHONPATH");

Moreover, bytes are decoded to Unicode (wchar_t) on UNIX.

This issue is now 4 years old and Serhiy just fixed one issue, so I close the issue.

Even if there is a risk of an issue, nobody came up with a concrete way to trigger a bug, so I don't think that it's a big issue. For example, the reported bug was on Py_GETENV("PYTHONPATH"), whereas this code is critical for Python: if it fails, everybody will complain. Except that since the bug has been reported, nobody ever saw an issue with this code. The code is part of the early code to initialize Python, when there is not possible to execute arbitrary code nor have a second thread, so we should be fine.