GeezerVison

This PR introduces a use of uninitialized memory.

• A new PyFunctionObject is allocated here
• And then here _PyFunction_SetVersion is called
• Which reads from ->func_version here
• However, ->func_version was never initialized

This was detected by OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5086904889245696

This PR introduces a use of uninitialized memory.

Interesting, since it also definitely fixed a case of free-after-use. I will try to understand the report.

Ah, I was over-zealous. That is the one place where ...->func_version = 0 is correct instead of going through the call. :-( PR coming up.

Thanks!

This is a great service! Surprised though that address-sanitizer didn't catch this.

ASAN doesn't catch unitialized memory, only MSAN does. (And MSAN is kind of a pain in the neck to setup.)

This PR introduces a use of uninitialized memory.

• A new PyFunctionObject is allocated here
• And then here _PyFunction_SetVersion is called
• Which reads from ->func_version here
• However, ->func_version was never initialized

This was detected by OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5086904889245696

Dear Alex @alex ,

Could you please give me an access to this issue? I am a security Ph.D. student, and I am analyzing some issues to summarize some patterns. I would be very grateful if you could help me.

Best regards,
Zeyang ([email protected], or [email protected])