2.7.18.16rc1 Windows fixes: tarfile seek overflow (CVE-2026-11972), SNI tests without socketpair

Lib/tarfile.py

@@ -555,10 +555,13 @@ def seek(self, pos=0):
         """
         if pos - self.pos >= 0:
             blocks, remainder = divmod(pos - self.pos, self.bufsize)
-            for i in xrange(blocks):
+            # Not xrange(): it takes a C long, which is 32 bits on Windows,
+            # and a header can declare a size that makes blocks huge.
+            while blocks > 0:
                 data = self.read(self.bufsize)
                 if not data:
                     break
+                blocks -= 1
             self.read(remainder)
         else:
             raise StreamError("seeking backwards is not allowed")

Lib/test/test_ssl.py

@@ -3318,7 +3318,16 @@ def make_server(sock):
                     sock, server_side=True, do_handshake_on_connect=False)
                 return server, weakref.ref(dispatch_ctx)
 
-            s1, s2 = [socket.socket(_sock=s) for s in socket.socketpair()]
+            if hasattr(socket, "socketpair"):
+                s1, s2 = [socket.socket(_sock=s) for s in socket.socketpair()]
+            else:
+                # 2.7 has no socketpair() on Windows; use a loopback TCP pair.
+                with closing(socket.socket()) as listener:
+                    listener.bind((HOST, 0))
+                    listener.listen(1)
+                    s2 = socket.socket()
+                    s2.connect(listener.getsockname())
+                    s1 = listener.accept()[0]
             self.addCleanup(s1.close)
             self.addCleanup(s2.close)
             server, dispatch_ref = make_server(s1)