Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Calling many methods on _ssl._SSLSocket() segfaults #126455

Copy link
Copy link
@devdanzin

Description

@devdanzin
Issue body actions

Crash report

What happened?

Calling many different methods on a _ssl._SSLSocket() instance causes a segfault, for example:

import _ssl
s = _ssl._SSLSocket()
s.shutdown()
# Segmentation fault

Other methods known to segfault are do_handshake, get_channel_binding, get_verified_chain (but not get_unverified_chain), getpeercert, read, verify_client_post_handshake, write. Backtrace looks like:

#0  0x00007ffff7b89129 in SSL_shutdown () from /lib/x86_64-linux-gnu/libssl.so.3
#1  0x00007ffff7c287bc in _ssl__SSLSocket_shutdown_impl (self=self@entry=0x20000572510) at ./Modules/_ssl.c:2710
#2  0x00007ffff7c28977 in _ssl__SSLSocket_shutdown (self=0x20000572510, _unused_ignored=<optimized out>)
    at ./Modules/clinic/_ssl.c.h:557
#3  0x0000555555694039 in method_vectorcall_NOARGS (func=<method_descriptor at remote 0x20000779380>, args=0x7fffffffd298,
    nargsf=<optimized out>, kwnames=<optimized out>) at Objects/descrobject.c:447
#4  0x000055555567ccec in _PyObject_VectorcallTstate (tstate=0x555555d2c2a0 <_PyRuntime+359904>,
    callable=<method_descriptor at remote 0x20000779380>, args=0x7fffffffd298, nargsf=9223372036854775809, kwnames=0x0)
    at ./Include/internal/pycore_call.h:167
#5  0x000055555567ce0b in PyObject_Vectorcall (callable=callable@entry=<method_descriptor at remote 0x20000779380>,
    args=args@entry=0x7fffffffd298, nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#6  0x0000555555841c09 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x555555d2c2a0 <_PyRuntime+359904>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:955
#7  0x000055555586fb1f in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x555555d2c2a0 <_PyRuntime+359904>)
    at ./Include/internal/pycore_ceval.h:116
#8  _PyEval_Vector (tstate=tstate@entry=0x555555d2c2a0 <_PyRuntime+359904>, func=func@entry=0x20000ad32d0,
    locals=locals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0x20000276e10>, '__spec__': None, '__builtins__': <module at remote 0x2000025c640>, '_ssl': <module at remote 0x20000778d60>, 's': <_ssl._SSLSocket at remote 0x20000572510>}, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1886
#9  0x000055555586fd6c in PyEval_EvalCode (co=co@entry=<code at remote 0x2000033f190>,
    globals=globals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0x20000276e10>, '__spec__': None, '__builtins__': <module at remote 0x2000025c640>, '_ssl': <module at remote 0x20000778d60>, 's': <_ssl._SSLSocket at remote 0x20000572510>},
    locals=locals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0x20000276e10>, '__spec__': None, '__builtins__': <module at remote 0x2000025c640>, '_ssl': <module at remote 0x20000778d60>, 's': <_ssl._SSLSocket at remote 0x20000572510>}) at Python/ceval.c:662

Found using fusil by @vstinner.

CPython versions tested on:

3.10, 3.11, 3.12, 3.13, 3.14, CPython main branch

Operating systems tested on:

Linux, Windows

Output from running 'python -VV' on the command line:

Python 3.14.0a1+ experimental free-threading build (heads/main-dirty:bfc1d2504c, Nov 4 2024, 07:55:58) [GCC 11.4.0]

Linked PRs

Reactions are currently unavailable

Metadata

Metadata

Assignees

Labels

3.12only security fixesonly security fixes3.13bugs and security fixesbugs and security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-SSLtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.