GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Calling many methods on `_ssl._SSLSocket()` segfaults · Issue #126455 · python/cpython

Calling many methods on _ssl._SSLSocket() segfaults #126455

New issue
Copy link
New issue
Copy link
Closed
Closed
Calling many methods on _ssl._SSLSocket() segfaults#126455
Copy link
Assignees
ZeroIntensity
Labels
3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-SSLtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Description

@devdanzin
devdanzin
opened on Nov 5, 2024
Issue body actions

Crash report

What happened?

Calling many different methods on a _ssl._SSLSocket() instance causes a segfault, for example:

import _ssl
s = _ssl._SSLSocket()
s.shutdown()
# Segmentation fault

Other methods known to segfault are do_handshake, get_channel_binding, get_verified_chain (but not get_unverified_chain), getpeercert, read, verify_client_post_handshake, write. Backtrace looks like:

#0  0x00007ffff7b89129 in SSL_shutdown () from /lib/x86_64-linux-gnu/libssl.so.3
#1  0x00007ffff7c287bc in _ssl__SSLSocket_shutdown_impl (self=self@entry=0x20000572510) at ./Modules/_ssl.c:2710
#2  0x00007ffff7c28977 in _ssl__SSLSocket_shutdown (self=0x20000572510, _unused_ignored=<optimized out>)
    at ./Modules/clinic/_ssl.c.h:557
#3  0x0000555555694039 in method_vectorcall_NOARGS (func=<method_descriptor at remote 0x20000779380>, args=0x7fffffffd298,
    nargsf=<optimized out>, kwnames=<optimized out>) at Objects/descrobject.c:447
#4  0x000055555567ccec in _PyObject_VectorcallTstate (tstate=0x555555d2c2a0 <_PyRuntime+359904>,
    callable=<method_descriptor at remote 0x20000779380>, args=0x7fffffffd298, nargsf=9223372036854775809, kwnames=0x0)
    at ./Include/internal/pycore_call.h:167
#5  0x000055555567ce0b in PyObject_Vectorcall (callable=callable@entry=<method_descriptor at remote 0x20000779380>,
    args=args@entry=0x7fffffffd298, nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#6  0x0000555555841c09 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x555555d2c2a0 <_PyRuntime+359904>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:955
#7  0x000055555586fb1f in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x555555d2c2a0 <_PyRuntime+359904>)
    at ./Include/internal/pycore_ceval.h:116
#8  _PyEval_Vector (tstate=tstate@entry=0x555555d2c2a0 <_PyRuntime+359904>, func=func@entry=0x20000ad32d0,
    locals=locals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0x20000276e10>, '__spec__': None, '__builtins__': <module at remote 0x2000025c640>, '_ssl': <module at remote 0x20000778d60>, 's': <_ssl._SSLSocket at remote 0x20000572510>}, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1886
#9  0x000055555586fd6c in PyEval_EvalCode (co=co@entry=<code at remote 0x2000033f190>,
    globals=globals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0x20000276e10>, '__spec__': None, '__builtins__': <module at remote 0x2000025c640>, '_ssl': <module at remote 0x20000778d60>, 's': <_ssl._SSLSocket at remote 0x20000572510>},
    locals=locals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0x20000276e10>, '__spec__': None, '__builtins__': <module at remote 0x2000025c640>, '_ssl': <module at remote 0x20000778d60>, 's': <_ssl._SSLSocket at remote 0x20000572510>}) at Python/ceval.c:662

Found using fusil by @vstinner.

CPython versions tested on:

3.10, 3.11, 3.12, 3.13, 3.14, CPython main branch

Operating systems tested on:

Linux, Windows

Output from running 'python -VV' on the command line:

Python 3.14.0a1+ experimental free-threading build (heads/main-dirty:bfc1d2504c, Nov 4 2024, 07:55:58) [GCC 11.4.0]

Linked PRs

  • gh-126455: Disallow _ssl.SSLSocket instantiation #126481
  • [3.13] gh-126455: Disallow _ssl.SSLSocket instantiation (GH-126481) #126486
  • [3.12] gh-126455: Disallow _ssl.SSLSocket instantiation (GH-126481) #126487

Activity

  1. devdanzin
    added
    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
    on Nov 5, 2024
  2. ZeroIntensity
    added
    extension-modulesC modules in the Modules dirC modules in the Modules dir
    topic-SSL
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    on Nov 5, 2024
  3. encukou
    added
    topic-free-threading
    on Nov 5, 2024
  4. ZeroIntensity commented on Nov 5, 2024

    @ZeroIntensity
    ZeroIntensity
    on Nov 5, 2024
    Member
    More actions

    I can probably deal with this considering my previous work with _ssl, unless someone else really wants to.

  5. devdanzin commented on Nov 5, 2024

    @devdanzin
    devdanzin
    on Nov 5, 2024
    MemberAuthor
    More actions

    Seems not to be related to free-threading, given being present in many previous versions.

    Reacted by Peter Bierma and Petr Viktorin
  6. encukou
    removed
    topic-free-threading
    on Nov 5, 2024
  7. ZeroIntensity
    self-assigned this
    on Nov 6, 2024
  8. rruuaanng commented on Nov 6, 2024

    @rruuaanng
    rruuaanng
    on Nov 6, 2024
    Contributor
    More actions

    I can probably deal with this considering my previous work with _ssl, unless someone else really wants to.

    If you don't mind, can you give it to me :)

  9. vstinner commented on Nov 6, 2024

    @vstinner
    vstinner
    on Nov 6, 2024
    Member
    More actions

    The problem is that it's possible to create an invalid SSLSocket:

    $ ./python -c 'import _ssl; _ssl._SSLSocket().context'
    Erreur de segmentation (core dumped)
    

    In the Python implementation, there is:

    class SSLSocket(socket):
        def __init__(self, *args, **kwargs):
            raise TypeError(
                f"{self.__class__.__name__} does not have a public "
                f"constructor. Instances are returned by "
                f"SSLContext.wrap_socket()."
            )

    Maybe the _ssl extension module needs a similar constructor.

  10. erlend-aasland commented on Nov 6, 2024

    @erlend-aasland
    erlend-aasland
    on Nov 6, 2024
    Contributor
    More actions

    If you don't mind, can you give it to me :)

    @rruuaanng: No, please do not. I suggest you instead focus on the many PRs you already have opened. Only when you're down to a handful of open PR, consider again to open a new PR.

    Reacted by RUANG (James Roy) and Victor Stinner
  11. vstinner
    added 2 commits that reference this issue on Nov 6, 2024

    pythongh-126455: Disallow _ssl.SSLSocket instantiation

    46bde1e

    pythongh-126455: Disallow _ssl.SSLSocket instantiation

    c70daa7
  12. vstinner commented on Nov 6, 2024

    @vstinner
    vstinner
    on Nov 6, 2024
    Member
    More actions

    I wrote #126481 to fix the issue.

    Reacted by Peter Bierma
  13. vstinner
    added a commit that references this issue on Nov 6, 2024

    gh-126455: Disallow _ssl.SSLSocket instantiation (#126481)

    b1c4ffc
  14. miss-islington
    added 2 commits that reference this issue on Nov 6, 2024

    pythongh-126455: Disallow _ssl.SSLSocket instantiation (pythonGH-126481)

    c5c4bd1

    pythongh-126455: Disallow _ssl.SSLSocket instantiation (pythonGH-126481)

    a873496
  15. vstinner commented on Nov 6, 2024

    @vstinner
    vstinner
    on Nov 6, 2024
    Member
    More actions

    Fixed. Thanks for the bug report.

  16. vstinner
    closed this as completedon Nov 6, 2024
  17. vstinner
    added 2 commits that reference this issue on Nov 6, 2024

    [3.12] gh-126455: Disallow _ssl.SSLSocket instantiation (GH-126481) (#…

    e6fd40b

    [3.13] gh-126455: Disallow _ssl.SSLSocket instantiation (GH-126481) (#…

    6a084b9
  18. ZeroIntensity commented on Nov 6, 2024

    @ZeroIntensity
    ZeroIntensity
    on Nov 6, 2024
    Member
    More actions

    Thanks for working on this!

  19. picnixz
    added a commit that references this issue on Dec 8, 2024

    pythongh-126455: Disallow _ssl.SSLSocket instantiation (python#126481)

    8abfb36
  20. ebonnal
    added a commit that references this issue on Jan 12, 2025

    pythongh-126455: Disallow _ssl.SSLSocket instantiation (python#126481)

    ecf4ced
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @ZeroIntensity
    ZeroIntensity

Labels

3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-SSLtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.