https://github.com/python/cpython/commit/a071788e3f438deb572b347cda5dbca7cd818c48
commit: a071788e3f438deb572b347cda5dbca7cd818c48
branch: main
author: Bénédikt Tran <[email protected]>
committer: picnixz <[email protected]>
date: 2026-10-19T12:26:38-07:00
summary:
gh-155782: avoid a crash in `ssl.SSLObject.group` for session-less objects
(#155829)
files:
A Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
M Lib/test/test_ssl.py
M Modules/_ssl.c
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index d8eebc33deebfa..d4213482cd1215 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -1135,6 +1135,16 @@ def test_set_server_sigalgs(self):
if CAN_IGNORE_UNKNOWN_OPENSSL_SIGALGS:
self.assertIsNone(ctx.set_server_sigalgs('rsa_pss_rsae_sha256:?foo'))
+ @unittest.skipUnless(CAN_GET_SELECTED_OPENSSL_GROUP,
+ "SSL library doesn't support getting selected group")
+ def test_no_session_group_does_not_crash(self):
+ # Ensure that .group() does not crash because of OpenSSL itself.
+ # See https://github.com/python/cpython/issues/155782.
+ ctx = ssl.create_default_context()
+ ctx.check_hostname = False
+ obj = ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
+ self.assertIsNone(obj.group())
+
def test_options(self):
# Test default SSLContext options
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
diff --git
a/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
new file mode 100644
index 00000000000000..cafa887044fa44
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
@@ -0,0 +1,2 @@
+:mod:`ssl`: prevent a crash in :meth:`~ssl.SSLSocket.group`
+for session-less objects on OpenSSL 3.2 and later. Patch by Bénédikt Tran.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 5fc029af24821a..6d43e59f36df7e 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -2197,7 +2197,9 @@ _ssl__SSLSocket_group_impl(PySSLSocket *self)
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
const char *group_name;
- if (self->ssl == NULL) {
+ // OpenSSL issue: SSL_get0_group_name(...) crashes if no session exists.
+ // See https://github.com/openssl/openssl/issues/32379.
+ if (self->ssl == NULL || SSL_get_session(self->ssl) == NULL) {
Py_RETURN_NONE;
}
group_name = SSL_get0_group_name(self->ssl);
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
