SIGN IN SIGN UP

gh-145244: Fix use-after-free on borrowed dict key in json encoder (GH-145245)

In encoder_encode_key_value(), key is a borrowed reference from
PyDict_Next(). If the default callback mutates or clears the dict,
key becomes a dangling pointer. The error path then calls
_PyErr_FormatNote("%R", key) on freed memory.

Fix by holding strong references to key and value unconditionally
during encoding, not just in the free-threading build.

Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
R
Ramin Farajpour Cami committed
8a466fa3d90a9e1f04d23c05ee2cf3f3c406ba30
Parent: daa2578
Committed by GitHub <noreply@github.com> on 4/11/2026, 10:26:36 PM