os.execve crashes when used via subprocess on Windows

[chris-eibl]

Bug report

Bug description:

The small reproducer

import os, sys
import subprocess

code = """
import os, sys
args = [sys.executable, '-c', 'print(4711)']
os.execve(args[0], args, {})
"""

cmd_line = [sys.executable, '-X', 'faulthandler', '-c', code]
env_1 = os.environ.copy()
env_2 = {}
env_2['SYSTEMROOT'] = os.environ['SYSTEMROOT']
proc = subprocess.Popen(
    cmd_line, stdin=subprocess.PIPE,
    stdout=subprocess.PIPE, stderr=subprocess.PIPE,
    env=env_1)
with proc:
    try:
        out, err = proc.communicate()
    finally:
        proc.kill()
        subprocess._cleanup()
print("rc", proc.returncode)
print("out", out)
print("err", err)

crashes using env_1 for me:

['e:\\cpython_clang\\PCbuild\\amd64\\python_d.exe', '-X', 'faulthandler', '-c', "import os, sys;args = [sys.executable, '-c', 'print(4711)'];os.execve(args[0], args, {})"]
rc 3221225477
out b''
err b'Windows fatal exception: access violation\n\nCurrent thread 0x00000b34 (most recent call first):\n  File "<string>", line 1 in <module>\n\nCurrent thread\'s C stack trace (most recent call first):\n  <cannot get C stack on this system>\n'

Found when analyizing broken Windows CI of #143314.

For Python 3.11. 3.12, 3.13 and 3.14 this almost always crashes. Python 3.10 also crashes, but more often succeeds.

Interestingly the "smaller" env_2 works. It seems to be the combination of subprocess and os.execve. Without subprocess, I do not see this problem.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

[johnslavik]

From a quick look, this looks very similar to GH-137934 which is a UCRT bug reproducible with a C snippet.
This one didn't use subprocess at all.
If the crash is somewhere around construct_environment_block, this might certainly be it -- it would be helpful to check with cdb and ucrtbased.dll.

Using os.exec*e and os.spawn*e on Windows is generally a russian roulette. A workaround would be to use a different shell, perhaps.

[chris-eibl]

Thanks for the linked issue. Indeed, a very similar if not the same problem.

[picnixz]

Oh right. If this is the issue, I think we can't avoid this to crash. So the UAF I fixed in #143314 would only be testable on POSIX.

[picnixz]

I'm going to close this one as not planned/wontfix because it's a buggy behavior on Windows unfortunately. The reason is either we are not inheriting enough variables or other stuff, but I don't think we need to bother about it.