Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-03-10 06:50:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.10] gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843) (#144862)

Browse source 
gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843)

In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.

Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
(cherry picked from commit c91638ca06)

Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
This commit is contained in:
Miss Islington (bot) 2026-03-02 23:55:00 +01:00 • committed by GitHub
parent 568342cfc8
commit 4be624a994
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Misc/NEWS.d/next/Library/2026-02-15-00-00-00.gh-issue-144833.TUelo1.rst Normal file
View file

@ -0,0 +1,3 @@
Fixed a use-after-free in :mod:`ssl` when ``SSL_new()`` returns NULL in
``newPySSLSocket()``. The error was reported via a dangling pointer after the
object had already been freed.

2
Modules/_ssl.c
View file

@ -846,8 +846,8 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
self->ssl = SSL_new(ctx);
PySSL_END_ALLOW_THREADS
if (self->ssl == NULL) {
_setSSLError(get_state_ctx(sslctx), NULL, 0, __FILE__, __LINE__);
Py_DECREF(self);
_setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__);
return NULL;
}
/* bpo43522 and OpenSSL < 1.1.1l: copy hostflags manually */