From cf48ead02b13baa01af9db88026c50cabee30739 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
Date: Fri, 7 Nov 2025 11:27:14 +0100
Subject: [PATCH] [3.14] gh-140734: fix off-by-one error when comparing to
 `_SUN_PATH_MAX` (GH-140903) (#141181)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

gh-140734: fix off-by-one error when comparing to `_SUN_PATH_MAX` (GH-140903)

The limit includes a NULL terminator.
(cherry picked from commit 9a199006733dae999f96c0f596c2035f4b9847b2)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
---
 Lib/multiprocessing/util.py                   | 20 +++++++++++--------
 ...-11-02-09-37-22.gh-issue-140734.f8gST9.rst |  2 ++
 2 files changed, 14 insertions(+), 8 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2025-11-02-09-37-22.gh-issue-140734.f8gST9.rst

diff --git a/Lib/multiprocessing/util.py b/Lib/multiprocessing/util.py
index a1a537dd48de..549fb07c2754 100644
--- a/Lib/multiprocessing/util.py
+++ b/Lib/multiprocessing/util.py
@@ -126,12 +126,14 @@ abstract_sockets_supported = _platform_supports_abstract_sockets()
 # Function returning a temp directory which will be removed on exit
 #
 
-# Maximum length of a socket file path is usually between 92 and 108 [1],
-# but Linux is known to use a size of 108 [2]. BSD-based systems usually
-# use a size of 104 or 108 and Windows does not create AF_UNIX sockets.
+# Maximum length of a NULL-terminated [1] socket file path is usually
+# between 92 and 108 [2], but Linux is known to use a size of 108 [3].
+# BSD-based systems usually use a size of 104 or 108 and Windows does
+# not create AF_UNIX sockets.
 #
-# [1]: https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_un.h.html
-# [2]: https://man7.org/linux/man-pages/man7/unix.7.html.
+# [1]: https://github.com/python/cpython/issues/140734
+# [2]: https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_un.h.html
+# [3]: https://man7.org/linux/man-pages/man7/unix.7.html
 
 if sys.platform == 'linux':
     _SUN_PATH_MAX = 108
@@ -171,11 +173,13 @@ def _get_base_temp_dir(tempfile):
     # generated by tempfile._RandomNameSequence, which, by design,
     # is 8 characters long.
     #
-    # Thus, the length of socket filename will be:
+    # Thus, the socket file path length (without NULL terminator) will be:
     #
     #   len(base_tempdir + '/pymp-XXXXXXXX' + '/sock-XXXXXXXX')
     sun_path_len = len(base_tempdir) + 14 + 14
-    if sun_path_len <= _SUN_PATH_MAX:
+    # Strict inequality to account for the NULL terminator.
+    # See https://github.com/python/cpython/issues/140734.
+    if sun_path_len < _SUN_PATH_MAX:
         return base_tempdir
     # Fallback to the default system-wide temporary directory.
     # This ignores user-defined environment variables.
@@ -201,7 +205,7 @@ def _get_base_temp_dir(tempfile):
         return base_tempdir
     warn("Ignoring user-defined temporary directory: %s", base_tempdir)
     # at most max(map(len, dirlist)) + 14 + 14 = 36 characters
-    assert len(base_system_tempdir) + 14 + 14 <= _SUN_PATH_MAX
+    assert len(base_system_tempdir) + 14 + 14 < _SUN_PATH_MAX
     return base_system_tempdir
 
 def get_temp_dir():
diff --git a/Misc/NEWS.d/next/Library/2025-11-02-09-37-22.gh-issue-140734.f8gST9.rst b/Misc/NEWS.d/next/Library/2025-11-02-09-37-22.gh-issue-140734.f8gST9.rst
new file mode 100644
index 000000000000..46582f7fcf41
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-11-02-09-37-22.gh-issue-140734.f8gST9.rst
@@ -0,0 +1,2 @@
+:mod:`multiprocessing`: fix off-by-one error when checking the length
+of a temporary socket file path. Patch by Bénédikt Tran.
-- 
2.47.3