[AnKiT-GaRG2]

Fixes the heap-use-after-free reported in #142637 for del od[key], od.pop(key) and od.move_to_end(key).

Looking up a key can call its __eq__, which may call od.clear() and so replace ma_keys:

• _odict_get_index_raw() read dk_nentries from a keys pointer cached before the lookup, which was freed by then.
• _odict_get_index() returned an index into an od_fast_nodes table sized for the old keys.

_odict_get_index() now looks the key up again when the keys were replaced during the lookup, which is what dict does, and _odict_get_index_raw() reads the current keys. The operations then behave like their dict counterparts: the key is not found, so KeyError is raised.

In the issue, @picnixz suggested either matching dict or raising RuntimeError as in gh-121329. I went with matching dict because it needs no new exception, but I can switch to RuntimeError if @rhettinger prefers that.

Tested with a debug build and a --with-address-sanitizer build: the three reproducers from the issue report a heap-use-after-free in _odict_get_index_raw without the change, and none with it. test_ordered_dict, test_dict and test_collections pass under ASAN.

• Issue: Use-after-free in several OrderedDict operations via re-entrant __eq__ #142637

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[picnixz]

Don't open PRs if the issue is still being discussed especially not if they are simply LLM generated.