[icanhasmath]

Two Windows-only problems in 2.7.18.16rc1 (2.7.18.16.rc1 = 2.7 @ 194c0c3), found by regression-testing the Platform's Windows x64 build (ActiveStateEnterpriseTesting/Core-Python-2.7 @ 388fde39) against 2.7.18.14 (@ f762bb28) on an EC2 Windows box.

Tracking: Linear PROD-1588.

Changes

1. tarfile: the CVE-2026-11972 fix did not hold on Windows — 8f9da53

The backport (337d3dd) makes _Stream.seek() stop at EOF but kept for i in xrange(blocks). On 2.7 xrange() takes a C long, which is 32 bits on Windows, so a header declaring a size near 264 (blocks ~ 251) raises OverflowError: Python int too large to convert to C long before the EOF check runs. A hostile archive escapes as an unexpected exception type instead of tarfile.ReadError. test_getmembers_big_size failed in all three stream modes (plain, gzip, bz2) on the Windows build; it passes on Linux, where C long is 64 bits. The loop now counts blocks down with while.

2. test_ssl: the CVE-2026-19445 SNI tests never ran on Windows — 2f8d0d4

sni_handshake_released_context() built its connection with socket.socketpair(), which 2.7 only has on POSIX, so both test_sni_callback_context_released_* tests errored with AttributeError and the fix in 7840229 went unexercised on Windows. It now falls back to a loopback TCP pair. Test-only.

Testing

• Windows x64 (the Platform rc1 runtime, with these two files dropped in): test_tarfile OK (304 tests); both SNI tests pass; the rest of test_ssl is unchanged.
• Linux x86_64, OpenSSL 1.1.1w: test_tarfile passes; test_ssl gives the same result with and without this change (only the network-dependent NetworkedTests.test_context_setget errors, as before).

Also seen on Windows, not changed here

• test_ssl NetworkedTests.test_connect_ex_error / test_non_blocking_connect_ex / test_timeout_connect_ex: sockets return WSAEWOULDBLOCK (10035) and WSAETIMEDOUT (10060), but errno.EWOULDBLOCK is 140 because VS2015+ errno.h defines the POSIX values. Same on 2.7.18.14; it only shows now because 2.7.18.14's test_ssl could not import on Windows (import mock, fixed in [2.7.18.16] Review follow-ups: _socket debug link, SNI None ref, sddl.h #111). That is PROD-1626.
• test_socket crashes at import on both builds (fcntl is never imported); separate issue.

After merge: tag 2.7.18.16.rc2, rebuild on the Platform, and rerun the Windows suite before the final 2.7.18.16 tag.

[ezequielp-activestate]

Approving. I reproduced both problems and confirmed both fixes.

tarfile (CVE-2026-11972 on Windows)
The overflow reproduces wherever C long is 32 bits, so I used 32-bit Linux 2.7 (i386/python:2.7, sys.maxint == 2**31-1). Only this branch's tarfile.py and Lib/test/ were laid over the interpreter.

• Base 2.7: test_getmembers_big_size errors in plain, gzip and bz2 stream modes with OverflowError: Python int too large to convert to C long, the same as the Windows rc1 result.
• This PR: the full test_tarfile passes (303 run, 1 skipped).

The other xrange() calls in tarfile.py can't take a size from an archive header. The only one with a length, copyfileobj(), is passed a size only from addfile(), where the caller supplies it; on extraction it is called without one and uses shutil.copyfileobj.

test_ssl SNI tests without socketpair()
I built this branch on Linux (OpenSSL 1.1.1d) and ran both test_sni_callback_context_released_* tests with socket.socketpair deleted first, so the new loopback-TCP branch runs. Both pass.