fix: avoid failed assert passing more arguments than placeholders

Fix #1791

Author: dvarrazzo

NEWS

@@ -5,6 +5,8 @@ What's new in psycopg 2.9.11
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 - Add support for Python 3.14.
+- Avoid a segfault passing more arguments than placeholders if Python is built
+  with assertions enabled (:ticket:`#1791`).
 - `~psycopg2.errorcodes` map and `~psycopg2.errors` classes updated to
   PostgreSQL 18.
 - Drop support for Python 3.8.

psycopg/cursor_type.c

@@ -342,7 +342,7 @@ _psyco_curs_merge_query_args(cursorObject *self,
             if (PyObject_HasAttrString(arg, "args")) {
                 PyObject *args = PyObject_GetAttrString(arg, "args");
                 PyObject *str = PySequence_GetItem(args, 0);
-                const char *s = Bytes_AS_STRING(str);
+                const char *s = PyUnicode_AsUTF8(str);
 
                 Dprintf("curs_execute:     -> %s", s);
 

tests/test_cursor.py

@@ -139,6 +139,11 @@ def test_bad_placeholder(self):
         self.assertRaises(psycopg2.ProgrammingError,
             cur.mogrify, "select %(foo, %(bar)", {'foo': 1, 'bar': 2})
 
+    def test_bad_params_number(self):
+        cur = self.conn.cursor()
+        self.assertRaises(IndexError, cur.execute, "select %s, %s", [1])
+        self.assertRaises(TypeError, cur.execute, "select %s", [1, 2])
+
     def test_cast(self):
         curs = self.conn.cursor()