gh-151763: Fix crash in PyList_New() on allocation failure under low memory

[Abhi210]

Fixes gh-152125 (one of the OOM-injection fuzzing findings tracked under the gh-151763 umbrella).

[sergey-miryanov]

The following two commands are safe, IIUC.

Suggested change

	Py_SET_SIZE(op, 0);
	op->allocated = 0;
	Py_SET_SIZE(op, size);

[sergey-miryanov]

And then we can remove this Py_SET_SIZE.

[sergey-miryanov]

Suggested change

op->allocated = 0;

[Abhi210]

So, for clarification, should I make the following changes?

+ op->ob_item = NULL;
- Py_SET_SIZE(op, 0);
- op->allocated = 0;

And keep the Py_SET_SIZE(op, size); at the end?

[sergey-miryanov]

If we call Py_SET_SIZE(op, size); at the top, then we don't need to repeat it at the bottom, IIUC.

[Abhi210]

I have made the suggested changes by putting Py_SET_SIZE(op, 0); and op->allocated = 0;. The reproduction script runs successfully without any crash.

[sergey-miryanov]

No, main idea to set size here, and set allocated=size before GC track. allocated is a gate which stops readers from reading not initialized memory.

So, I propose something like:

op->ob_item = NULL;
op->allocated = 0;
Py_SET_SIZE(op, size);

// ...
// ...
op->allocated = size;
_PyObject_GC_TRACK(op);