Segfault calling: `SSLObject.group()` before a session has been established
@picnixz y travaille déjà.
Depuis le 15/8/2026.
- Langage dominant
- Python
- Étoiles
- 77.2k
- Forks
- 35.9k
- Métriques de merge des PR
- Métriques de PR en attente
Description
Crash report
What happened?
Python 3.16.0a0 (heads/main-dirty:716cbae, Aug 13 2026, 11:31:04) [Clang 22.1.8 ] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
...
... context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
... ssl_object = context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
... print(ssl_object.group())
...
Segmentation fault
Here's the script:
import ssl
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ssl_object = context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
print(ssl_object.group())
LLDB Stack
(lldb) run
Process 92 launched: '/pfm/py/bin/python3' (aarch64)
Process 92 stopped
* thread #1, name = 'python3', stop reason = signal SIGSEGV: address not mapped to object (fault address=0x308)
frame #0: 0x0000fffff77c4e1c libssl.so.3`SSL_get0_group_name + 156
libssl.so.3`SSL_get0_group_name:
-> 0xfffff77c4e1c <+156>: ldr w1, [x0, #0x308]
0xfffff77c4e20 <+160>: ldr x0, [x2, #0x8]
0xfffff77c4e24 <+164>: adrp x16, 235
0xfffff77c4e28 <+168>: ldr x16, [x16, #0x670]
(lldb) bt
* thread #1, name = 'python3', stop reason = signal SIGSEGV: address not mapped to object (fault address=0x308)
* frame #0: 0x0000fffff77c4e1c libssl.so.3`SSL_get0_group_name + 156
frame #1: 0x0000fffff7903fc0 _ssl.cpython-316d-aarch64-linux-gnu.so`_ssl__SSLSocket_group_impl(self=0x0000fffff7a59b70) at _ssl.c:2230:18 [inlined]
frame #2: 0x0000fffff7903fac _ssl.cpython-316d-aarch64-linux-gnu.so`_ssl__SSLSocket_group(self=0x0000fffff7a59b70, _unused_ignored=0x0000000000000000) at _ssl.c.h:219:20
frame #3: 0x0000aaaaaaedb49c python3`method_vectorcall_NOARGS(func=0x0000fffff7a098b0, args=0x0000ffffffffcc40, nargsf=9223372036854775809, kwnames=0x0000000000000000) at descrobject.c:448:24
frame #4: 0x0000aaaaaaeb0b64 python3`_PyObject_VectorcallTstate(tstate=0x0000aaaaab7f98e0, callable=0x0000fffff7a098b0, args=0x0000ffffffffcc40, nargsf=9223372036854775809, kwnames=0x0000000000000000) at pycore_call.h:144:11
frame #5: 0x0000aaaaab2d7d64 python3`PyObject_Vectorcall(callable=<unavailable>, args=0x0000ffffffffcc40, nargsf=<unavailable>, kwnames=0x0000000000000000) at call.c:327:12 [inlined]
frame #6: 0x0000aaaaab2d7d54 python3`_Py_VectorCallInstrumentation_StackRefSteal(callable=<unavailable>, arguments=0x0000fffff7fe90f8, total_args=<unavailable>, kwnames=(bits = 1), call_instrumentation=false, frame=0x0000fffff7fe9098, this_instr=0x0000fffff7adb3d6, tstate=0x0000aaaaab7f98e0) at ceval.c:768:11
frame #7: 0x0000aaaaab28436c python3`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=<unavailable>, throwflag=<unavailable>) at generated_cases.c.h:1906:35
frame #8: 0x0000aaaaab270f54 python3`_PyEval_EvalFrame(tstate=0x0000aaaaab7f98e0, frame=0x0000fffff7fe9020, throwflag=0) at pycore_ceval.h:122:16 [inlined]
frame #9: 0x0000aaaaab270f2c python3`_PyEval_Vector(tstate=<unavailable>, func=<unavailable>, locals=0x0000fffff7acd610, args=<unavailable>, argcount=<unavailable>, kwnames=0x0000000000000000) at ceval.c:2172:12
frame #10: 0x0000aaaaab2708f0 python3`PyEval_EvalCode(co=0x0000fffff7c95a80, globals=0x0000fffff7acd610, locals=0x0000fffff7acd610) at ceval.c:679:21
Python side call site:
https://github.com/python/cpython/blob/5d91cf6487eb5aa37107598c792573f61ebe310f/Modules/_ssl.c#L2227-L2230
This looks pretty much like an OpenSSL bug.
The openssl docs say:
If SSL_get0_group_name() returns NULL, an error occurred; possibly no TLS session has been established
strongly implying that we should get NULL return rather than a null dereference.
There's a fix been added to pyopenssl:
https://github.com/pyca/pyopenssl/pull/1442#discussion_r2356925889
And I've just raised an openssl bug:
https://github.com/openssl/openssl/issues/32379
The intended behaviour is in the PR review comments:
What happens if the handshake hasn't been initiated or completed yet? If this returns NULL in that case, it would be good to mention it.
Good point, I'm not actually sure if it would return NULL or just break. I will make sure it returns NULL and update the doc to reflect it.
The Python function was introduced by:
commit 377b78761814e7d848361e642d376881739d5a29
Author: Ron Frederick <ronf@timeheart.net>
Date: Mon Jul 28 10:33:31 2025 -0700
gh-136306: Add support for getting and setting SSL groups (#136307)
tagging: @ronf
This issue has been in openssl 3.2 up to master.
While this is really an upstream issue, it seems reasonable to consider a python level fix, the conditions for this happening are quite easy to detect, and it means that python has a fix immediately?
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.16.0a0 (heads/main-dirty:716cbae, Aug 13 2026, 11:31:04) [Clang 22.1.8 ]
Linked PRs
- gh-155829
Guide de contribution
Ouvrir le guide de contribution
Par où commencer
- Lisez l'issue en entier, puis le guide de contribution du projet.
- Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
- Forkez le dépôt et travaillez sur une branche.
- Ouvrez une pull request qui référence le numéro de l'issue.
Évaluation
Cette issue n'a pas encore été évaluée.