8000 bpo-32533: Fixed thread-safety of error handling in _ssl. by zooba · Pull Request #7158 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

bpo-32533: Fixed thread-safety of error handling in _ssl. #7158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 17, 2018
Merged

bpo-32533: Fixed thread-safety of error handling in _ssl. #7158

merged 1 commit into from
Sep 17, 2018

Conversation

zooba
Copy link
Member
@zooba zooba commented May 28, 2018 •
edited by bedevere-bot
Loading

@zooba zooba added type-bug An unexpected behavior, bug, or error needs backport to 3.6 labels May 28, 2018
@zooba zooba requested a review from tiran May 28, 2018 15:57
tiran
tiran previously requested changes May 28, 2018
View reviewed changes
Modules/_ssl.c
@@ -455,20 +459,19 @@ static PyTypeObject PySSLSocket_Type;
static PyTypeObject PySSLMemoryBIO_Type;
static PyTypeObject PySSLSession_Type;

static inline _PySSLError _PySSL_errno(int failed, const SSL *ssl, int retcode)
{
_PySSLError err = { 0 };
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC that's not safe in C code. You are allocating a struct on the stack and then return the stack allocated struct to the caller. Once you return to the caller, the stack allocated memory becomes invalid and may be reused in another function call.

See https://cwe.mitre.org/data/definitions/562.html

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It returns a copy, not a pointer.
8000

@bedevere-bot
Copy link

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

@zooba
Copy link
Member Author
zooba commented May 28, 2018 •
edited
Loading

I have made the requested changes; please review again (not really, but I answered the comment)

@bedevere-bot
Copy link

Thanks for making the requested changes!

@tiran: please review the changes made to this pull request.
8000

@ned-deily
Copy link
Member

@tiran, will you time to review the changes you requested?

@zooba zooba dismissed tiran’s stale review September 17, 2018 18:34

Too slow to respond

@zooba zooba merged commit c6fd1c1 into python:master Sep 17, 2018
@miss-islington
Copy link
Contributor

Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 17, 2018
@zooba @miss-islington
bpo-32533: Fixed thread-safety of error handling in _ssl. (pythonGH-7158
b94daa3 
)

(cherry picked from commit c6fd1c1)

Co-authored-by: Steve Dower <steve.dower@microsoft.com>
@bedevere-bot
Copy link

GH-9363 is a backport of this pull request to the 3.7 branch.

@miss-islington
Copy link
Contributor

Sorry, @zooba, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker c6fd1c1c3a65217958b68df3a4991e4f306e9b7d 3.6

@zooba zooba deleted the bpo-32533 branch September 17, 2018 18:35
miss-islington added a commit that referenced this pull request Sep 17, 2018
@miss-islington @zooba
bpo-32533: Fixed thread-safety of error handling in _ssl. (GH-7158)
1229664 
(cherry picked from commit c6fd1c1)

Co-authored-by: Steve Dower <steve.dower@microsoft.com>
zooba added a commit to zooba/cpython that referenced this pull request Sep 17, 2018
@zooba
bpo-32533: Fixed thread-safety of error handling in _ssl. (pythonGH-7158
925d253 
)
@bedevere-bot
Copy link

GH-9365 is a backport of this pull request to the 3.6 branch.

zooba added a commit that referenced this pull request Sep 17, 2018
@zooba
bpo-32533: Fixed thread-safety of error handling in _ssl. (GH-7158)
1a107ee
@shihai1991 shihai1991 mentioned this pull request Jan 6, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tiran tiran tiran left review comments

Assignees

@zooba zooba

Labels
type-bug An unexpected behavior, bug, or error
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@zooba @bedevere-bot @ned-deily @miss-islington @tiran @the-knights-who-say-ni
0