multidict C Extension Analysis Report

[devdanzin]

I ran a code analysis tool I'm developing on multidict and it generated an interesting report: https://gist.github.com/devdanzin/a36588ae7e2b73f0d85f8a925fb13b3d. It contains issue descriptions, suggested fixes, and reproducers for some of the issues.

From the summary:

The most critical finding is a double-free/use-after-free in md_contains and a crash from swapped format string arguments in _err_cannot_fetch. The iterator and view types are also missing the heap type lifecycle management (Py_VISIT(Py_TYPE(self))) that the main dict types correctly implement.

I hope it helps.

[Vizonex]

Interesting report I've labeled this issue as something that can be worked with because there is a reproducer that is in fact present.

[Vizonex]

I figured out that _err_cannot_fetch is in fact crashable so I will be looking into a fix soon.