Neither conn_recv_string() nor its callers free *newbuffer on error. The promotion rules break negative 'res' for 64-bit Py_ssize_t in the (ulength <= buflength) branch: res = -1 ==> (UINT32)-1 ==> Py_ssize_t 0xffffffff instead of -1. While I'm writing: The _conn_recvall() calls can be factored out of the if(). This patch applies to both 3.2a3 and 2.7. However, the patched failure cases are untested: I do not know how to test them. It passes make test.
Richard Oudkerk <report@bugs.python.org> wrote: > Thanks for the patch, I have applied it. (I don't think there was a > problem with the promotion rules because res was a never converted to > UINT32.) True now that res is a Py_ssize_t. It was int when I wrote the patch. Hallvard