Skip to content

bpo-32533: Fixed thread-safety of error handling in _ssl.#7158

Merged
zooba merged 1 commit intopython:masterfrom
zooba:bpo-32533
Sep 17, 2018
Merged

bpo-32533: Fixed thread-safety of error handling in _ssl.#7158
zooba merged 1 commit intopython:masterfrom
zooba:bpo-32533

Conversation

@zooba
Copy link
Member

@zooba zooba commented May 28, 2018 •
edited by bedevere-bot
Loading

@zooba zooba added type-bug An unexpected behavior, bug, or error needs backport to 3.6 labels May 28, 2018
@zooba zooba requested a review from tiran May 28, 2018 15:57
tiran
tiran previously requested changes May 28, 2018
View reviewed changes
Modules/_ssl.c

static inline _PySSLError _PySSL_errno(int failed, const SSL *ssl, int retcode)
{
_PySSLError err = { 0 };
Copy link
Member

@tiran tiran May 28, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC that's not safe in C code. You are allocating a struct on the stack and then return the stack allocated struct to the caller. Once you return to the caller, the stack allocated memory becomes invalid and may be reused in another function call.

See https://cwe.mitre.org/data/definitions/562.html

Copy link
Member Author

@zooba zooba May 28, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It returns a copy, not a pointer.

@bedevere-bot
Copy link

bedevere-bot commented May 28, 2018

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

@zooba
Copy link
Member Author

zooba commented May 28, 2018 •
edited
Loading

I have made the requested changes; please review again (not really, but I answered the comment)

@bedevere-bot
Copy link

bedevere-bot commented May 28, 2018

Thanks for making the requested changes!

@tiran: please review the changes made to this pull request.

@ned-deily
Copy link
Member

ned-deily commented May 30, 2018

@tiran, will you time to review the changes you requested?

@zooba zooba dismissed tiran’s stale review September 17, 2018 18:34

Too slow to respond

@zooba zooba merged commit c6fd1c1 into python:master Sep 17, 2018
@miss-islington
Copy link
Contributor

miss-islington commented Sep 17, 2018

Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 17, 2018
@zooba @miss-islington
bpo-32533: Fixed thread-safety of error handling in _ssl. (pythonGH-7158
b94daa3 
)

(cherry picked from commit c6fd1c1)

Co-authored-by: Steve Dower <steve.dower@microsoft.com>
@bedevere-bot
Copy link

bedevere-bot commented Sep 17, 2018

GH-9363 is a backport of this pull request to the 3.7 branch.

@miss-islington
Copy link
Contributor

miss-islington commented Sep 17, 2018

Sorry, @zooba, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker c6fd1c1c3a65217958b68df3a4991e4f306e9b7d 3.6

@zooba zooba deleted the bpo-32533 branch September 17, 2018 18:35
miss-islington added a commit that referenced this pull request Sep 17, 2018
@miss-islington @zooba
bpo-32533: Fixed thread-safety of error handling in _ssl. (GH-7158)
1229664 
(cherry picked from commit c6fd1c1)

Co-authored-by: Steve Dower <steve.dower@microsoft.com>
zooba added a commit to zooba/cpython that referenced this pull request Sep 17, 2018
@zooba
bpo-32533: Fixed thread-safety of error handling in _ssl. (pythonGH-7158
925d253 
)
@bedevere-bot
Copy link

bedevere-bot commented Sep 17, 2018

GH-9365 is a backport of this pull request to the 3.6 branch.

zooba added a commit that referenced this pull request Sep 17, 2018
@zooba
bpo-32533: Fixed thread-safety of error handling in _ssl. (GH-7158)
1a107ee
@shihai1991 shihai1991 mentioned this pull request Jan 6, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tiran tiran tiran left review comments

Assignees

@zooba zooba

Labels

type-bug An unexpected behavior, bug, or error

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@zooba @bedevere-bot @ned-deily @miss-islington @tiran @the-knights-who-say-ni