Thanks to Coverity, these were all reported by their Prevent tool.

All of these (except _lsprof.c) should be backported.  Particularly
the hotshot change which validates sys.path.  Can someone backport?