https://github.com/python/cpython/commit/c91638ca0671b8038831f963ed44e66cdda006a2
commit: c91638ca0671b8038831f963ed44e66cdda006a2
branch: main
author: Ramin Farajpour Cami <[email protected]>
committer: gpshead <[email protected]>
date: 2026-02-15T18:43:07-08:00
summary:
gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843)
In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.
Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
files:
A Misc/NEWS.d/next/Library/2026-02-15-00-00-00.gh-issue-144833.TUelo1.rst
M Modules/_ssl.c
diff --git
a/Misc/NEWS.d/next/Library/2026-02-15-00-00-00.gh-issue-144833.TUelo1.rst
b/Misc/NEWS.d/next/Library/2026-02-15-00-00-00.gh-issue-144833.TUelo1.rst
new file mode 100644
index 00000000000000..6d5b18f59ee7ea
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-02-15-00-00-00.gh-issue-144833.TUelo1.rst
@@ -0,0 +1,3 @@
+Fixed a use-after-free in :mod:`ssl` when ``SSL_new()`` returns NULL in
+``newPySSLSocket()``. The error was reported via a dangling pointer after the
+object had already been freed.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 66d699b4339ce3..b0c0d8deeecd23 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -917,8 +917,8 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject
*sock,
self->ssl = SSL_new(ctx);
PySSL_END_ALLOW_THREADS(sslctx)
if (self->ssl == NULL) {
+ _setSSLError(get_state_ctx(sslctx), NULL, 0, __FILE__, __LINE__);
Py_DECREF(self);
- _setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__);
return NULL;
}
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
