]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.10] gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843...
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 2 Mar 2026 22:55:00 +0000 (23:55 +0100)
committerGitHub <noreply@github.com>
Mon, 2 Mar 2026 22:55:00 +0000 (22:55 +0000)
commit4be624a99472e5540825ebbda2a3e22bb3893e24
tree25b6a2b1cf96b0b4d559fc4501c80914c5b00eec
parent568342cfc8f002d9a15f30238f26b9d2e0e79036
[3.10] gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843) (#144862)

gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843)

In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.

Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
(cherry picked from commit c91638ca0671b8038831f963ed44e66cdda006a2)

Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
Misc/NEWS.d/next/Library/2026-02-15-00-00-00.gh-issue-144833.TUelo1.rst [new file with mode: 0644]
Modules/_ssl.c