gh-108253: Fix bug in func version cache

[gvanrossum]

When a function object changed its version, a stale pointer might remain in the cache.

Now, test_opcache just fails when run with -Xuops instead of accessing freed memory. This fixesgh-108253.

[alex]

This PR introduces a use of uninitialized memory.

• A new PyFunctionObject is allocated here
• And then here_PyFunction_SetVersion is called
• Which reads from ->func_versionhere
• However, ->func_version was never initialized

This was detected by OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5086904889245696

[gvanrossum]

This PR introduces a use of uninitialized memory.

Interesting, since it also definitely fixed a case of free-after-use. I will try to understand the report.

[gvanrossum]

Ah, I was over-zealous. That is the one place where ...->func_version = 0 is correct instead of going through the call. :-( PR coming up.

[alex]

Thanks!

[gvanrossum]

This is a great service! Surprised though that address-sanitizer didn't catch this.

[alex]

ASAN doesn't catch unitialized memory, only MSAN does. (And MSAN is kind of a pain in the neck to setup.)

[llooFlashooll]

This PR introduces a use of uninitialized memory.

• A new PyFunctionObject is allocated here
• And then here_PyFunction_SetVersion is called
• Which reads from ->func_versionhere
• However, ->func_version was never initialized

This was detected by OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5086904889245696

Dear Alex @alex ,

Could you please give me an access to this issue? I am a security Ph.D. student, and I am analyzing some issues to summarize some patterns. I would be very grateful if you could help me.

Best regards,
Zeyang (zeyangzhuang0315@gmail.com, or zyzhuang22@cse.cuhk.edu.hk)