Crash report
Bug description:
This is an issue just to track the progress of fixing the UAF on fut->fut_callback0 (see #125833 (comment)).
The UAF that could be exploited by clearing fut._callbacks won't be triggered anymore since after #125922, we will not mutate the internal list itself anymore but it is still be possilbe to mutate fut->fut_callback0 directly: #125833 (comment).
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
Crash report
Bug description:
This is an issue just to track the progress of fixing the UAF on
fut->fut_callback0(see #125833 (comment)).The UAF that could be exploited by clearing
fut._callbackswon't be triggered anymore since after #125922, we will not mutate the internal list itself anymore but it is still be possilbe to mutatefut->fut_callback0directly: #125833 (comment).CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
fut->fut_callback0due to an evil callback's__eq__#125967fut->fut_callback0due to an evil callback's__eq__in asyncio (GH-125967) #126047fut->fut_callback0due to an evil callback's__eq__in asyncio (GH-125967) #126048