gh-42400: Fix buffer overflow in _Py_wrealpath for long paths

[ashm-dev]

Fixes buffer overflow (CVE-2006-1542) in _Py_wrealpath() when handling paths longer than MAXPATHLEN (4096 bytes).

Changed realpath(path, buffer) to realpath(path, NULL) for dynamic allocation.

Closes #42400

• Issue: Avoid using unsafe realpath #42400

[ashm-dev]

I don't think the errors in the UBSAN test are related to this fix, as they occur for a completely different reason and generally in import tests.

[ashm-dev]

@vstinner Could you please review this PR?

[vstinner]

I updated the PR to retrieve the fix for the UBSan CI.

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @vstinner for commit f882e26 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F141529%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[vstinner]

realpath(path, NULL) seems to be a recent feature. Let me check on buildbots if it's supported by all platforms supported by Python.

[vstinner]

Change merged, thanks.

The change passed on our fleet of stable buildbots.

Even if the change was documented in the Security category, I don't think that it's worth it to backport it to stable branches (yet). I'm afraid of breaking the Python build on some weird platforms where realpath(path, NULL) is not supported. So I prefer to make the change only in the main branch for now.