Handle malformed RFC 2231 continuations in parse_options_header

[manunio]

Summary

• handle both ValueError (oversized RFC 2231 index) and TypeError (mixed continuation forms) from Message.get_params()
• add regression tests covering oversized index and mixed RFC 2231 continuation inputs to prevent fuzz-found crashes
• Update cifuzz action for sarif crash fix: cifuzz: handle empty frames in get_error_frame to prevent IndexError google/oss-fuzz#15352
• A Pre-check for mixed RFC2231 parameter continuations was added as email.message.Message.get_params() handles these maliciously formed headers differently in Python 3.12 vs 3.13

Why

parse_options_header relied on stdlib email parsing that can raise different exception types for malformed parameter continuations. These changes keep existing behavior while making parser failure handling robust and preventing constant fuzzer crashes(improves its performance)

Validation

• uv run pytest -q
• uv run ruff check python_multipart/exceptions.py python_multipart/multipart.py tests/test_multipart.py

[Kludex]

Thanks @manunio 🙏

[manunio]

I’m returning the header as is to avoid regex magic for parser differences between python versions.

[manunio]

@Kludex i have also updated the cifuzz action as the fix for oss-fuzz sarif bug was merged recently.

[manunio]

Hi @Kludex Just checking in to see if there is anything else you need from my side to get this merged.

[Kludex]

I don't want the behavior to be different in different Python versions (and I don't think we should use assertIn).

I just noticed the above after checking it properly.

[Kludex]

I didn't have time to propose improvements, that's why I went silent here.

[manunio]

Thanks for the review, I have update the code and test, so that it stays consistent against diff python version.

[manunio]

I have been fuzzing the parse_options_header function with the above fix for a few hours on my vps; no issues have been detected so far.

Edit: I’ve now been running this all day with no issues. I think it’s good to go.

[manunio]

Hi @Kludex, Please review this whenever you're free.

[manunio]

I have update the code to handle a false positive edge case(earlier fix was not handelling the the semicolon inside quoted string well).

[codspeed-hq]

Merging this PR will not alter performance

✅ 5 untouched benchmarks

---

_{Comparing manunio:fix-bugs-found-by-fuzz (7dc606b) with main (75c33b2)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b051895e62

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Kludex]

@manunio Sorry for the delay and back and forth in this PR. Nowadays, given AI, your contributions are the ones that I enjoy the most.

I've thought a bit more about this, and I think the simpler solution you had before was fine - with the tweak that I actually want a path forward for when we drop Python 3.12.