Skip to content

Commit e708ac8

Browse files
picnixzpicnixz
authored
gh-111178: fix UBSan failures in Modules/_ssl.c (GH-130719)
* fix UBSan failures for `PySSLContext`, `PySSLSocket`, `PySSLMemoryBIO`, `PySSLSession`
1 parent a45f253 commit e708ac8

File tree

3 files changed

+67
-35
lines changed

3 files changed

+67
-35
lines changed

‎Modules/_ssl.c‎

Lines changed: 48 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,8 @@ typedef struct {
312312
#endif
313313
} PySSLContext;
314314

315+
#define PySSLContext_CAST(op) ((PySSLContext *)(op))
316+
315317
typedef struct {
316318
int ssl; /* last seen error from SSL */
317319
int c; /* last seen error from libc */
@@ -337,18 +339,24 @@ typedef struct {
337339
PyObject *exc;
338340
} PySSLSocket;
339341

342+
#define PySSLSocket_CAST(op) ((PySSLSocket *)(op))
343+
340344
typedef struct {
341345
PyObject_HEAD
342346
BIO *bio;
343347
int eof_written;
344348
} PySSLMemoryBIO;
345349

350+
#define PySSLMemoryBIO_CAST(op) ((PySSLMemoryBIO *)(op))
351+
346352
typedef struct {
347353
PyObject_HEAD
348354
SSL_SESSION *session;
349355
PySSLContext *ctx;
350356
} PySSLSession;
351357

358+
#define PySSLSession_CAST(op) ((PySSLSession *)(op))
359+
352360
static inline _PySSLError _PySSL_errno(int failed, const SSL *ssl, int retcode)
353361
{
354362
_PySSLError err = { 0 };
@@ -2317,23 +2325,26 @@ _ssl__SSLSocket_owner_set_impl(PySSLSocket *self, PyObject *value)
23172325
}
23182326

23192327
static int
2320-
PySSL_traverse(PySSLSocket *self, visitproc visit, void *arg)
2328+
PySSL_traverse(PyObject *op, visitproc visit, void *arg)
23212329
{
2330+
PySSLSocket *self = PySSLSocket_CAST(op);
23222331
Py_VISIT(self->exc);
23232332
Py_VISIT(Py_TYPE(self));
23242333
return 0;
23252334
}
23262335

23272336
static int
2328-
PySSL_clear(PySSLSocket *self)
2337+
PySSL_clear(PyObject *op)
23292338
{
2339+
PySSLSocket *self = PySSLSocket_CAST(op);
23302340
Py_CLEAR(self->exc);
23312341
return 0;
23322342
}
23332343

23342344
static void
2335-
PySSL_dealloc(PySSLSocket *self)
2345+
PySSL_dealloc(PyObject *op)
23362346
{
2347+
PySSLSocket *self = PySSLSocket_CAST(op);
23372348
PyTypeObject *tp = Py_TYPE(self);
23382349
PyObject_GC_UnTrack(self);
23392350
if (self->ssl) {
@@ -3278,17 +3289,19 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
32783289
}
32793290

32803291
static int
3281-
context_traverse(PySSLContext *self, visitproc visit, void *arg)
3292+
context_traverse(PyObject *op, visitproc visit, void *arg)
32823293
{
3294+
PySSLContext *self = PySSLContext_CAST(op);
32833295
Py_VISIT(self->set_sni_cb);
32843296
Py_VISIT(self->msg_cb);
32853297
Py_VISIT(Py_TYPE(self));
32863298
return 0;
32873299
}
32883300

32893301
static int
3290-
context_clear(PySSLContext *self)
3302+
context_clear(PyObject *op)
32913303
{
3304+
PySSLContext *self = PySSLContext_CAST(op);
32923305
Py_CLEAR(self->set_sni_cb);
32933306
Py_CLEAR(self->msg_cb);
32943307
Py_CLEAR(self->keylog_filename);
@@ -3306,15 +3319,16 @@ context_clear(PySSLContext *self)
33063319
}
33073320

33083321
static void
3309-
context_dealloc(PySSLContext *self)
3322+
context_dealloc(PyObject *op)
33103323
{
3324+
PySSLContext *self = PySSLContext_CAST(op);
33113325
PyTypeObject *tp = Py_TYPE(self);
33123326
/* bpo-31095: UnTrack is needed before calling any callbacks */
33133327
PyObject_GC_UnTrack(self);
3314-
context_clear(self);
3328+
(void)context_clear(op);
33153329
SSL_CTX_free(self->ctx);
33163330
PyMem_FREE(self->alpn_protocols);
3317-
Py_TYPE(self)->tp_free(self);
3331+
tp->tp_free(self);
33183332
Py_DECREF(tp);
33193333
}
33203334

@@ -3908,7 +3922,9 @@ _ssl__SSLContext_check_hostname_set_impl(PySSLContext *self, PyObject *value)
39083922
}
39093923

39103924
static PyObject *
3911-
get_post_handshake_auth(PySSLContext *self, void *c) {
3925+
get_post_handshake_auth(PyObject *op, void *Py_UNUSED(closure))
3926+
{
3927+
PySSLContext *self = PySSLContext_CAST(op);
39123928
#if defined(PySSL_HAVE_POST_HS_AUTH)
39133929
return PyBool_FromLong(self->post_handshake_auth);
39143930
#else
@@ -3918,7 +3934,9 @@ get_post_handshake_auth(PySSLContext *self, void *c) {
39183934

39193935
#if defined(PySSL_HAVE_POST_HS_AUTH)
39203936
static int
3921-
set_post_handshake_auth(PySSLContext *self, PyObject *arg, void *c) {
3937+
set_post_handshake_auth(PyObject *op, PyObject *arg, void *Py_UNUSED(closure))
3938+
{
3939+
PySSLContext *self = PySSLContext_CAST(op);
39223940
if (arg == NULL) {
39233941
PyErr_SetString(PyExc_AttributeError, "cannot delete attribute");
39243942
return -1;
@@ -5197,18 +5215,18 @@ static PyGetSetDef context_getsetlist[] = {
51975215
_SSL__SSLCONTEXT__HOST_FLAGS_GETSETDEF
51985216
_SSL__SSLCONTEXT_MINIMUM_VERSION_GETSETDEF
51995217
_SSL__SSLCONTEXT_MAXIMUM_VERSION_GETSETDEF
5200-
{"keylog_filename", (getter) _PySSLContext_get_keylog_filename,
5201-
(setter) _PySSLContext_set_keylog_filename, NULL},
5202-
{"_msg_callback", (getter) _PySSLContext_get_msg_callback,
5203-
(setter) _PySSLContext_set_msg_callback, NULL},
5218+
{"keylog_filename", _PySSLContext_get_keylog_filename,
5219+
_PySSLContext_set_keylog_filename, NULL},
5220+
{"_msg_callback", _PySSLContext_get_msg_callback,
5221+
_PySSLContext_set_msg_callback, NULL},
52045222
_SSL__SSLCONTEXT_SNI_CALLBACK_GETSETDEF
52055223
#if defined(TLS1_3_VERSION) && !defined(OPENSSL_NO_TLS1_3)
52065224
_SSL__SSLCONTEXT_NUM_TICKETS_GETSETDEF
52075225
#endif
52085226
_SSL__SSLCONTEXT_OPTIONS_GETSETDEF
5209-
{"post_handshake_auth", (getter) get_post_handshake_auth,
5227+
{"post_handshake_auth", get_post_handshake_auth,
52105228
#if defined(PySSL_HAVE_POST_HS_AUTH)
5211-
(setter) set_post_handshake_auth,
5229+
set_post_handshake_auth,
52125230
#else
52135231
NULL,
52145232
#endif
@@ -5300,19 +5318,20 @@ _ssl_MemoryBIO_impl(PyTypeObject *type)
53005318
}
53015319

53025320
static int
5303-
memory_bio_traverse(PySSLMemoryBIO *self, visitproc visit, void *arg)
5321+
memory_bio_traverse(PyObject *self, visitproc visit, void *arg)
53045322
{
53055323
Py_VISIT(Py_TYPE(self));
53065324
return 0;
53075325
}
53085326

53095327
static void
5310-
memory_bio_dealloc(PySSLMemoryBIO *self)
5328+
memory_bio_dealloc(PyObject *op)
53115329
{
5330+
PySSLMemoryBIO *self = PySSLMemoryBIO_CAST(op);
53125331
PyTypeObject *tp = Py_TYPE(self);
53135332
PyObject_GC_UnTrack(self);
5314-
BIO_free(self->bio);
5315-
Py_TYPE(self)->tp_free(self);
5333+
(void)BIO_free(self->bio);
5334+
tp->tp_free(self);
53165335
Py_DECREF(tp);
53175336
}
53185337

@@ -5492,8 +5511,9 @@ static PyType_Spec PySSLMemoryBIO_spec = {
54925511
*/
54935512

54945513
static void
5495-
PySSLSession_dealloc(PySSLSession *self)
5514+
PySSLSession_dealloc(PyObject *op)
54965515
{
5516+
PySSLSession *self = PySSLSession_CAST(op);
54975517
PyTypeObject *tp = Py_TYPE(self);
54985518
/* bpo-31095: UnTrack is needed before calling any callbacks */
54995519
PyObject_GC_UnTrack(self);
@@ -5514,7 +5534,7 @@ PySSLSession_richcompare(PyObject *left, PyObject *right, int op)
55145534
}
55155535

55165536
int result;
5517-
PyTypeObject *sesstype = ((PySSLSession*)left)->ctx->state->PySSLSession_Type;
5537+
PyTypeObject *sesstype = PySSLSession_CAST(left)->ctx->state->PySSLSession_Type;
55185538

55195539
if (!Py_IS_TYPE(left, sesstype) || !Py_IS_TYPE(right, sesstype)) {
55205540
Py_RETURN_NOTIMPLEMENTED;
@@ -5525,9 +5545,9 @@ PySSLSession_richcompare(PyObject *left, PyObject *right, int op)
55255545
} else {
55265546
const unsigned char *left_id, *right_id;
55275547
unsigned int left_len, right_len;
5528-
left_id = SSL_SESSION_get_id(((PySSLSession *)left)->session,
5548+
left_id = SSL_SESSION_get_id(PySSLSession_CAST(left)->session,
55295549
&left_len);
5530-
right_id = SSL_SESSION_get_id(((PySSLSession *)right)->session,
5550+
right_id = SSL_SESSION_get_id(PySSLSession_CAST(right)->session,
55315551
&right_len);
55325552
if (left_len == right_len) {
55335553
result = memcmp(left_id, right_id, left_len);
@@ -5564,16 +5584,18 @@ PySSLSession_richcompare(PyObject *left, PyObject *right, int op)
55645584
}
55655585

55665586
static int
5567-
PySSLSession_traverse(PySSLSession *self, visitproc visit, void *arg)
5587+
PySSLSession_traverse(PyObject *op, visitproc visit, void *arg)
55685588
{
5589+
PySSLSession *self = PySSLSession_CAST(op);
55695590
Py_VISIT(self->ctx);
55705591
Py_VISIT(Py_TYPE(self));
55715592
return 0;
55725593
}
55735594

55745595
static int
5575-
PySSLSession_clear(PySSLSession *self)
5596+
PySSLSession_clear(PyObject *op)
55765597
{
5598+
PySSLSession *self = PySSLSession_CAST(op);
55775599
Py_CLEAR(self->ctx);
55785600
return 0;
55795601
}

‎Modules/_ssl/cert.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -153,13 +153,13 @@ _x509name_print(_sslmodulestate *state, X509_NAME *name, int indent, unsigned lo
153153
* PySSLCertificate_Type
154154
*/
155155

156-
#define _PySSLCertificate_CAST(op) ((PySSLCertificate *)(op))
156+
#define PySSLCertificate_CAST(op) ((PySSLCertificate *)(op))
157157

158158
static PyObject *
159159
certificate_repr(PyObject *op)
160160
{
161161
PyObject *osubject, *result;
162-
PySSLCertificate *self = _PySSLCertificate_CAST(op);
162+
PySSLCertificate *self = PySSLCertificate_CAST(op);
163163

164164
/* subject string is ASCII encoded, UTF-8 chars are quoted */
165165
osubject = _x509name_print(
@@ -181,7 +181,7 @@ certificate_repr(PyObject *op)
181181
static Py_hash_t
182182
certificate_hash(PyObject *op)
183183
{
184-
PySSLCertificate *self = _PySSLCertificate_CAST(op);
184+
PySSLCertificate *self = PySSLCertificate_CAST(op);
185185
if (self->hash == (Py_hash_t)-1) {
186186
unsigned long hash;
187187
hash = X509_subject_name_hash(self->cert);
@@ -198,7 +198,7 @@ static PyObject *
198198
certificate_richcompare(PyObject *lhs, PyObject *rhs, int op)
199199
{
200200
int cmp;
201-
PySSLCertificate *self = _PySSLCertificate_CAST(lhs);
201+
PySSLCertificate *self = PySSLCertificate_CAST(lhs);
202202
_sslmodulestate *state = get_state_cert(self);
203203

204204
if (Py_TYPE(rhs) != state->PySSLCertificate_Type) {
@@ -219,7 +219,7 @@ certificate_richcompare(PyObject *lhs, PyObject *rhs, int op)
219219
static void
220220
certificate_dealloc(PyObject *op)
221221
{
222-
PySSLCertificate *self = _PySSLCertificate_CAST(op);
222+
PySSLCertificate *self = PySSLCertificate_CAST(op);
223223
PyTypeObject *tp = Py_TYPE(self);
224224
X509_free(self->cert);
225225
(void)Py_TYPE(self)->tp_free(self);

‎Modules/_ssl/debughelpers.c‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,9 @@ _PySSL_msg_callback(int write_p, int version, int content_type,
8585

8686

8787
static PyObject *
88-
_PySSLContext_get_msg_callback(PySSLContext *self, void *c) {
88+
_PySSLContext_get_msg_callback(PyObject *op, void *Py_UNUSED(closure))
89+
{
90+
PySSLContext *self = PySSLContext_CAST(op);
8991
if (self->msg_cb != NULL) {
9092
return Py_NewRef(self->msg_cb);
9193
} else {
@@ -94,7 +96,10 @@ _PySSLContext_get_msg_callback(PySSLContext *self, void *c) {
9496
}
9597

9698
static int
97-
_PySSLContext_set_msg_callback(PySSLContext *self, PyObject *arg, void *c) {
99+
_PySSLContext_set_msg_callback(PyObject *op, PyObject *arg,
100+
void *Py_UNUSED(closure))
101+
{
102+
PySSLContext *self = PySSLContext_CAST(op);
98103
Py_CLEAR(self->msg_cb);
99104
if (arg == Py_None) {
100105
SSL_CTX_set_msg_callback(self->ctx, NULL);
@@ -153,7 +158,9 @@ _PySSL_keylog_callback(const SSL *ssl, const char *line)
153158
}
154159

155160
static PyObject *
156-
_PySSLContext_get_keylog_filename(PySSLContext *self, void *c) {
161+
_PySSLContext_get_keylog_filename(PyObject *op, void *Py_UNUSED(closure))
162+
{
163+
PySSLContext *self = PySSLContext_CAST(op);
157164
if (self->keylog_filename != NULL) {
158165
return Py_NewRef(self->keylog_filename);
159166
} else {
@@ -162,7 +169,10 @@ _PySSLContext_get_keylog_filename(PySSLContext *self, void *c) {
162169
}
163170

164171
static int
165-
_PySSLContext_set_keylog_filename(PySSLContext *self, PyObject *arg, void *c) {
172+
_PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
173+
void *Py_UNUSED(closure))
174+
{
175+
PySSLContext *self = PySSLContext_CAST(op);
166176
FILE *fp;
167177
/* Reset variables and callback first */
168178
SSL_CTX_set_keylog_callback(self->ctx, NULL);

0 commit comments

Comments
 (0)