Skip to content

Commit 45894e0

Browse files
sobolevnsobolevn
committed
gh-111230: Fix _ssl.c not checking for errors when initializing a module
1 parent be551a7 commit 45894e0

File tree

2 files changed

+61
-46
lines changed

2 files changed

+61
-46
lines changed

‎Misc/NEWS.d/next/Library/2023-10-23-22-40-47.gh-issue-111230.k3Jm84.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Fix :mod:`ssl` not checking for errors when initializing.

‎Modules/_ssl.c‎

Lines changed: 60 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -5787,51 +5787,58 @@ sslmodule_add_option(PyObject *m, const char *name, uint64_t value)
57875787
static int
57885788
sslmodule_init_constants(PyObject *m)
57895789
{
5790-
PyModule_AddStringConstant(m, "_DEFAULT_CIPHERS",
5791-
PY_SSL_DEFAULT_CIPHER_STRING);
5790+
if (PyModule_AddStringConstant(m, "_DEFAULT_CIPHERS",
5791+
PY_SSL_DEFAULT_CIPHER_STRING) < 0) {
5792+
return -1;
5793+
}
5794+
5795+
#define _PyModule_ADD_INT_CONST(module, name, value) \
5796+
if (PyModule_AddIntConstant(module, name, value) < 0) { \
5797+
return -1; \
5798+
}
57925799

5793-
PyModule_AddIntConstant(m, "SSL_ERROR_ZERO_RETURN",
5800+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_ZERO_RETURN",
57945801
PY_SSL_ERROR_ZERO_RETURN);
5795-
PyModule_AddIntConstant(m, "SSL_ERROR_WANT_READ",
5802+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_WANT_READ",
57965803
PY_SSL_ERROR_WANT_READ);
5797-
PyModule_AddIntConstant(m, "SSL_ERROR_WANT_WRITE",
5804+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_WANT_WRITE",
57985805
PY_SSL_ERROR_WANT_WRITE);
5799-
PyModule_AddIntConstant(m, "SSL_ERROR_WANT_X509_LOOKUP",
5806+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_WANT_X509_LOOKUP",
58005807
PY_SSL_ERROR_WANT_X509_LOOKUP);
5801-
PyModule_AddIntConstant(m, "SSL_ERROR_SYSCALL",
5808+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_SYSCALL",
58025809
PY_SSL_ERROR_SYSCALL);
5803-
PyModule_AddIntConstant(m, "SSL_ERROR_SSL",
5810+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_SSL",
58045811
PY_SSL_ERROR_SSL);
5805-
PyModule_AddIntConstant(m, "SSL_ERROR_WANT_CONNECT",
5812+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_WANT_CONNECT",
58065813
PY_SSL_ERROR_WANT_CONNECT);
58075814
/* non ssl.h errorcodes */
5808-
PyModule_AddIntConstant(m, "SSL_ERROR_EOF",
5815+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_EOF",
58095816
PY_SSL_ERROR_EOF);
5810-
PyModule_AddIntConstant(m, "SSL_ERROR_INVALID_ERROR_CODE",
5817+
_PyModule_ADD_INT_CONST(m, "SSL_ERROR_INVALID_ERROR_CODE",
58115818
PY_SSL_ERROR_INVALID_ERROR_CODE);
58125819
/* cert requirements */
5813-
PyModule_AddIntConstant(m, "CERT_NONE",
5820+
_PyModule_ADD_INT_CONST(m, "CERT_NONE",
58145821
PY_SSL_CERT_NONE);
5815-
PyModule_AddIntConstant(m, "CERT_OPTIONAL",
5822+
_PyModule_ADD_INT_CONST(m, "CERT_OPTIONAL",
58165823
PY_SSL_CERT_OPTIONAL);
5817-
PyModule_AddIntConstant(m, "CERT_REQUIRED",
5824+
_PyModule_ADD_INT_CONST(m, "CERT_REQUIRED",
58185825
PY_SSL_CERT_REQUIRED);
58195826
/* CRL verification for verification_flags */
5820-
PyModule_AddIntConstant(m, "VERIFY_DEFAULT",
5827+
_PyModule_ADD_INT_CONST(m, "VERIFY_DEFAULT",
58215828
0);
5822-
PyModule_AddIntConstant(m, "VERIFY_CRL_CHECK_LEAF",
5829+
_PyModule_ADD_INT_CONST(m, "VERIFY_CRL_CHECK_LEAF",
58235830
X509_V_FLAG_CRL_CHECK);
5824-
PyModule_AddIntConstant(m, "VERIFY_CRL_CHECK_CHAIN",
5831+
_PyModule_ADD_INT_CONST(m, "VERIFY_CRL_CHECK_CHAIN",
58255832
X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
5826-
PyModule_AddIntConstant(m, "VERIFY_X509_STRICT",
5833+
_PyModule_ADD_INT_CONST(m, "VERIFY_X509_STRICT",
58275834
X509_V_FLAG_X509_STRICT);
5828-
PyModule_AddIntConstant(m, "VERIFY_ALLOW_PROXY_CERTS",
5835+
_PyModule_ADD_INT_CONST(m, "VERIFY_ALLOW_PROXY_CERTS",
58295836
X509_V_FLAG_ALLOW_PROXY_CERTS);
5830-
PyModule_AddIntConstant(m, "VERIFY_X509_TRUSTED_FIRST",
5837+
_PyModule_ADD_INT_CONST(m, "VERIFY_X509_TRUSTED_FIRST",
58315838
X509_V_FLAG_TRUSTED_FIRST);
58325839

58335840
#ifdef X509_V_FLAG_PARTIAL_CHAIN
5834-
PyModule_AddIntConstant(m, "VERIFY_X509_PARTIAL_CHAIN",
5841+
_PyModule_ADD_INT_CONST(m, "VERIFY_X509_PARTIAL_CHAIN",
58355842
X509_V_FLAG_PARTIAL_CHAIN);
58365843
#endif
58375844

@@ -5840,7 +5847,7 @@ sslmodule_init_constants(PyObject *m)
58405847
/* http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6 */
58415848

58425849
#define ADD_AD_CONSTANT(s) \
5843-
PyModule_AddIntConstant(m, "ALERT_DESCRIPTION_"#s, \
5850+
_PyModule_ADD_INT_CONST(m, "ALERT_DESCRIPTION_"#s, \
58445851
SSL_AD_##s)
58455852

58465853
ADD_AD_CONSTANT(CLOSE_NOTIFY);
@@ -5888,22 +5895,22 @@ sslmodule_init_constants(PyObject *m)
58885895

58895896
/* protocol versions */
58905897
#ifndef OPENSSL_NO_SSL3
5891-
PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
5898+
_PyModule_ADD_INT_CONST(m, "PROTOCOL_SSLv3",
58925899
PY_SSL_VERSION_SSL3);
58935900
#endif
5894-
PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",
5901+
_PyModule_ADD_INT_CONST(m, "PROTOCOL_SSLv23",
58955902
PY_SSL_VERSION_TLS);
5896-
PyModule_AddIntConstant(m, "PROTOCOL_TLS",
5903+
_PyModule_ADD_INT_CONST(m, "PROTOCOL_TLS",
58975904
PY_SSL_VERSION_TLS);
5898-
PyModule_AddIntConstant(m, "PROTOCOL_TLS_CLIENT",
5905+
_PyModule_ADD_INT_CONST(m, "PROTOCOL_TLS_CLIENT",
58995906
PY_SSL_VERSION_TLS_CLIENT);
5900-
PyModule_AddIntConstant(m, "PROTOCOL_TLS_SERVER",
5907+
_PyModule_ADD_INT_CONST(m, "PROTOCOL_TLS_SERVER",
59015908
PY_SSL_VERSION_TLS_SERVER);
5902-
PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",
5909+
_PyModule_ADD_INT_CONST(m, "PROTOCOL_TLSv1",
59035910
PY_SSL_VERSION_TLS1);
5904-
PyModule_AddIntConstant(m, "PROTOCOL_TLSv1_1",
5911+
_PyModule_ADD_INT_CONST(m, "PROTOCOL_TLSv1_1",
59055912
PY_SSL_VERSION_TLS1_1);
5906-
PyModule_AddIntConstant(m, "PROTOCOL_TLSv1_2",
5913+
_PyModule_ADD_INT_CONST(m, "PROTOCOL_TLSv1_2",
59075914
PY_SSL_VERSION_TLS1_2);
59085915

59095916
#define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1
@@ -5949,50 +5956,54 @@ sslmodule_init_constants(PyObject *m)
59495956
ADD_OPTION("OP_ENABLE_KTLS", SSL_OP_ENABLE_KTLS);
59505957
#endif
59515958

5959+
#undef ADD_OPTION
5960+
59525961
#ifdef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5953-
PyModule_AddIntConstant(m, "HOSTFLAG_ALWAYS_CHECK_SUBJECT",
5962+
_PyModule_ADD_INT_CONST(m, "HOSTFLAG_ALWAYS_CHECK_SUBJECT",
59545963
X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT);
59555964
#endif
59565965
#ifdef X509_CHECK_FLAG_NEVER_CHECK_SUBJECT
5957-
PyModule_AddIntConstant(m, "HOSTFLAG_NEVER_CHECK_SUBJECT",
5966+
_PyModule_ADD_INT_CONST(m, "HOSTFLAG_NEVER_CHECK_SUBJECT",
59585967
X509_CHECK_FLAG_NEVER_CHECK_SUBJECT);
59595968
#endif
59605969
#ifdef X509_CHECK_FLAG_NO_WILDCARDS
5961-
PyModule_AddIntConstant(m, "HOSTFLAG_NO_WILDCARDS",
5970+
_PyModule_ADD_INT_CONST(m, "HOSTFLAG_NO_WILDCARDS",
59625971
X509_CHECK_FLAG_NO_WILDCARDS);
59635972
#endif
59645973
#ifdef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
5965-
PyModule_AddIntConstant(m, "HOSTFLAG_NO_PARTIAL_WILDCARDS",
5974+
_PyModule_ADD_INT_CONST(m, "HOSTFLAG_NO_PARTIAL_WILDCARDS",
59665975
X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
59675976
#endif
59685977
#ifdef X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS
5969-
PyModule_AddIntConstant(m, "HOSTFLAG_MULTI_LABEL_WILDCARDS",
5978+
_PyModule_ADD_INT_CONST(m, "HOSTFLAG_MULTI_LABEL_WILDCARDS",
59705979
X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS);
59715980
#endif
59725981
#ifdef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
5973-
PyModule_AddIntConstant(m, "HOSTFLAG_SINGLE_LABEL_SUBDOMAINS",
5982+
_PyModule_ADD_INT_CONST(m, "HOSTFLAG_SINGLE_LABEL_SUBDOMAINS",
59745983
X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS);
59755984
#endif
59765985

59775986
/* file types */
5978-
PyModule_AddIntConstant(m, "ENCODING_PEM", PY_SSL_ENCODING_PEM);
5979-
PyModule_AddIntConstant(m, "ENCODING_DER", PY_SSL_ENCODING_DER);
5987+
_PyModule_ADD_INT_CONST(m, "ENCODING_PEM", PY_SSL_ENCODING_PEM);
5988+
_PyModule_ADD_INT_CONST(m, "ENCODING_DER", PY_SSL_ENCODING_DER);
59805989

59815990
/* protocol versions */
5982-
PyModule_AddIntConstant(m, "PROTO_MINIMUM_SUPPORTED",
5991+
_PyModule_ADD_INT_CONST(m, "PROTO_MINIMUM_SUPPORTED",
59835992
PY_PROTO_MINIMUM_SUPPORTED);
5984-
PyModule_AddIntConstant(m, "PROTO_MAXIMUM_SUPPORTED",
5993+
_PyModule_ADD_INT_CONST(m, "PROTO_MAXIMUM_SUPPORTED",
59855994
PY_PROTO_MAXIMUM_SUPPORTED);
5986-
PyModule_AddIntConstant(m, "PROTO_SSLv3", PY_PROTO_SSLv3);
5987-
PyModule_AddIntConstant(m, "PROTO_TLSv1", PY_PROTO_TLSv1);
5988-
PyModule_AddIntConstant(m, "PROTO_TLSv1_1", PY_PROTO_TLSv1_1);
5989-
PyModule_AddIntConstant(m, "PROTO_TLSv1_2", PY_PROTO_TLSv1_2);
5990-
PyModule_AddIntConstant(m, "PROTO_TLSv1_3", PY_PROTO_TLSv1_3);
5995+
_PyModule_ADD_INT_CONST(m, "PROTO_SSLv3", PY_PROTO_SSLv3);
5996+
_PyModule_ADD_INT_CONST(m, "PROTO_TLSv1", PY_PROTO_TLSv1);
5997+
_PyModule_ADD_INT_CONST(m, "PROTO_TLSv1_1", PY_PROTO_TLSv1_1);
5998+
_PyModule_ADD_INT_CONST(m, "PROTO_TLSv1_2", PY_PROTO_TLSv1_2);
5999+
_PyModule_ADD_INT_CONST(m, "PROTO_TLSv1_3", PY_PROTO_TLSv1_3);
59916000

59926001
#define addbool(m, key, value) \
59936002
do { \
59946003
PyObject *bool_obj = (value) ? Py_True : Py_False; \
5995-
PyModule_AddObjectRef((m), (key), bool_obj); \
6004+
if (PyModule_AddObjectRef((m), (key), bool_obj) < 0) { \
6005+
return -1; \
6006+
} \
59966007
} while (0)
59976008

59986009
addbool(m, "HAS_SNI", 1);
@@ -6033,6 +6044,9 @@ sslmodule_init_constants(PyObject *m)
60336044
addbool(m, "HAS_TLSv1_3", 0);
60346045
#endif
60356046

6047+
#undef addbool
6048+
#undef _PyModule_ADD_INT_CONST
6049+
60366050
return 0;
60376051
}
60386052

0 commit comments

Comments
 (0)