gh-136306: Address additional review comments

Author: ronf

Lib/test/test_ssl.py

@@ -964,22 +964,15 @@ def test_get_ciphers(self):
 
     def test_set_groups(self):
         ctx = ssl.create_default_context()
-
-        # Test valid group list
         self.assertIsNone(ctx.set_groups('P-256:X25519'))
-
-        # Test invalid group list
         self.assertRaises(ssl.SSLError, ctx.set_groups, 'P-256:xxx')
 
     @unittest.skipUnless(CAN_GET_AVAILABLE_OPENSSL_GROUPS,
                          "OpenSSL version doesn't support getting groups")
     def test_get_groups(self):
         ctx = ssl.create_default_context()
-
-        # P-256 isn't an IANA name, so it shouldn't be returned by default
+        # By default, only return official IANA names.
         self.assertNotIn('P-256', ctx.get_groups())
-
-        # Aliases like P-256 sbould be returned when include_aliases is set
         self.assertIn('P-256', ctx.get_groups(include_aliases=True))
 
     def test_options(self):

Modules/_ssl.c

@@ -3462,7 +3462,7 @@ _ssl__SSLContext_get_groups_impl(PySSLContext *self, int include_aliases)
 #if OPENSSL_VERSION_NUMBER >= 0x30500000L
     STACK_OF(OPENSSL_CSTRING) *groups = NULL;
     const char *group;
-    size_t i, num;
+    int i, num;
     PyObject *item, *result = NULL;
 
     // This "groups" object is dynamically allocated, but the strings inside
@@ -3492,7 +3492,7 @@ _ssl__SSLContext_get_groups_impl(PySSLContext *self, int include_aliases)
         // Group names are plain ASCII, so there's no chance of a decoding
         // error here. However, an allocation failure could occur when
         // constructing the Unicode version of the names.
-        item = PyUnicode_DecodeFSDefault(group);
+        item = PyUnicode_DecodeASCII(group, strlen(group), "strict");
         if (item == NULL) {
             _setSSLError(get_state_ctx(self), "Can't allocate group name", 0, __FILE__, __LINE__);
             goto error;