Commit edb61e8
fix format error that leads to segfaults (#1310)
<!-- Thank you for your contribution! -->
## What do these changes do?
This was based off a user-accessible segfault found by @devdanzin. Not
sure how this appeared out of nowhere but my best assumption it could've
been caused by developer fatigue or burn out. The reproducible seen in
this gist here
https://gist.github.com/devdanzin/a36588ae7e2b73f0d85f8a925fb13b3d is
not just limited to 3.14 but also 3.10 (which I have now recently tested
myself) so I've gone ahead and fixed it. Feel free to let me know if
this should somehow be added to pytest although IDK where to put it.
Originally was going to write this off as an ffmpeg fiasco but this does
not seem to be the case. Seems we might have couple of other sneaky bugs
to patch.
Reproducer from the gist brought here for reference
```python
"""Reproducer: multidict _err_cannot_fetch swapped format args — abort.
hashtable.h:1467-1475 passes (name, i) but format expects (i, name).
%zd receives a char* → prints garbage number
%s receives an int → dereferences integer as pointer → crash
No special setup required.
Tested: multidict 6.7.1, Python 3.14.
"""
from multidict import MultiDict
class BadItem:
"""Looks like a 2-element sequence but __getitem__ raises."""
def __len__(self):
return 2
def __getitem__(self, i):
raise RuntimeError("intentional getitem failure")
MultiDict([BadItem()])
# Expected: ValueError with proper error message
# Actual: Aborted (core dumped)
# Assertion `!_PyErr_Occurred(tstate)' failed.
```
## Are there changes in behavior for the user?
<!-- Outline any notable behaviour for the end users. -->
## Related issue number
> [!NOTE]
> This does not close this issue as there is still other information
about other bugs that have yet to be patched.
#1306
<!-- Are there any issues opened that will be resolved by merging this
change? -->
<!-- Remember to prefix with 'Fixes' if it should close the issue (e.g.
'Fixes #123'). -->
## Checklist
- [x] I think the code is well written
- [x] Unit tests for the changes exist
- [x] Documentation reflects the changes
---------
Co-authored-by: J. Nick Koston <nick@koston.org>
Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <wk.cvs.github@sydorenko.org.ua>
Co-authored-by: J. Nick Koston <nick@home-assistant.io>1 parent 6e5577d commit edb61e8
File tree
4 files changed
+57
-5
lines changed- CHANGES
- multidict
- _multilib
- tests
4 files changed
+57
-5
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
834 | 834 | | |
835 | 835 | | |
836 | 836 | | |
837 | | - | |
838 | | - | |
| 837 | + | |
| 838 | + | |
| 839 | + | |
| 840 | + | |
| 841 | + | |
| 842 | + | |
| 843 | + | |
| 844 | + | |
| 845 | + | |
| 846 | + | |
| 847 | + | |
| 848 | + | |
| 849 | + | |
| 850 | + | |
| 851 | + | |
| 852 | + | |
839 | 853 | | |
840 | 854 | | |
841 | 855 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1470 | 1470 | | |
1471 | 1471 | | |
1472 | 1472 | | |
1473 | | - | |
1474 | | - | |
| 1473 | + | |
| 1474 | + | |
1475 | 1475 | | |
1476 | 1476 | | |
1477 | 1477 | | |
| |||
1507 | 1507 | | |
1508 | 1508 | | |
1509 | 1509 | | |
1510 | | - | |
1511 | 1510 | | |
1512 | 1511 | | |
1513 | 1512 | | |
1514 | 1513 | | |
| 1514 | + | |
1515 | 1515 | | |
1516 | 1516 | | |
1517 | 1517 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
300 | 300 | | |
301 | 301 | | |
302 | 302 | | |
| 303 | + | |
| 304 | + | |
| 305 | + | |
| 306 | + | |
| 307 | + | |
| 308 | + | |
| 309 | + | |
| 310 | + | |
| 311 | + | |
| 312 | + | |
| 313 | + | |
| 314 | + | |
| 315 | + | |
| 316 | + | |
| 317 | + | |
| 318 | + | |
| 319 | + | |
| 320 | + | |
| 321 | + | |
| 322 | + | |
| 323 | + | |
| 324 | + | |
| 325 | + | |
| 326 | + | |
| 327 | + | |
| 328 | + | |
| 329 | + | |
| 330 | + | |
| 331 | + | |
| 332 | + | |
| 333 | + | |
| 334 | + | |
| 335 | + | |
| 336 | + | |
| 337 | + | |
| 338 | + | |
303 | 339 | | |
304 | 340 | | |
305 | 341 | | |
| |||
0 commit comments