From 9f7d5cbd456896808255607c15218934f0bd7636 Mon Sep 17 00:00:00 2001 From: Zackery Spytz Date: Sat, 6 Oct 2018 11:41:45 -0600 Subject: [PATCH] bpo-34824: Fix a possible NULL pointer dereference in _ssl.c (GH-9606) On failure, _PyBytes_Resize() will deallocate the bytes object and set "result" to NULL. https://bugs.python.org/issue34824 (cherry picked from commit 365ad2ead5bbaf7a3b18648ffa36e819559d3f75) Co-authored-by: Zackery Spytz --- .../2018-09-27-11-10-02.bpo-34824.VLlCaU.rst | 2 ++ Modules/_ssl.c | 9 +++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2018-09-27-11-10-02.bpo-34824.VLlCaU.rst diff --git a/Misc/NEWS.d/next/Core and Builtins/2018-09-27-11-10-02.bpo-34824.VLlCaU.rst b/Misc/NEWS.d/next/Core and Builtins/2018-09-27-11-10-02.bpo-34824.VLlCaU.rst new file mode 100644 index 00000000000000..fe95b8973c09a4 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2018-09-27-11-10-02.bpo-34824.VLlCaU.rst @@ -0,0 +1,2 @@ +Fix a possible null pointer dereference in Modules/_ssl.c. Patch by Zackery +Spytz. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index b0cfbdc96c073d..2b043da280b8a3 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -4365,12 +4365,17 @@ _ssl_MemoryBIO_read_impl(PySSLMemoryBIO *self, int len) return result; nbytes = BIO_read(self->bio, PyBytes_AS_STRING(result), len); - /* There should never be any short reads but check anyway. */ - if ((nbytes < len) && (_PyBytes_Resize(&result, len) < 0)) { + if (nbytes < 0) { Py_DECREF(result); + _setSSLError(NULL, 0, __FILE__, __LINE__); return NULL; } + /* There should never be any short reads but check anyway. */ + if (nbytes < len) { + _PyBytes_Resize(&result, nbytes); + } + return result; }