gh-158583: Fix uninitialized memory read in bytes.fromhex() - #158584

cc @StanFromIreland

bytes.fromhex() was modified in Python 3.14 to accept more types; Python 3.13 only accepts str. So the undefined behavior was introduced in Python 3.14. So far, before me running Valgrind, nobody reported the issue. So I'm not sure if it's needed to add a Changelog entry.

The modified code is tested by BytesTest.test_fromhex() and ByteArrayTest.test_fromhex() of test_bytes. For example, running the test in Valgrind reports the issue.

In Python 3.13, reading str[hexlen] is fine because str object always allocate a trailing null character: https://docs.python.org/dev/c-api/unicode.html.

The internal buffer always includes an extra trailing null character for compatibility with null terminated C strings.

I'm also curious why only Valgrind reports the issue. In the CI, we are running the Python test suite on Python built with Address Sanitizer. This build doesn't detect usage of uninitialized memory?

Apparently, when array.array() created from bytes, it's overallocated. One created from a list gives me a crash under ASAN; could you add a test with it?

bytes.fromhex(array.array('B', [ord('2')] * 5))

In the CI, we are running the Python test suite on Python built with Address Sanitizer. This build doesn't detect usage of uninitialized memory?

We only run with ASan and UBSan, however neither track uninitialised memory. We'd have to run with MSan.

Edit: I went off on a little tangent, but I wrote a patch to add MSan to the CI: #158625