python 3.9 segfault in libssl SSL_get_peer_certificate

[xeron]

Crash report

What happened?

I'm getting segfaults in python 3.9 on macOS 15.1.1 with openssl 3.4.0 from homebrew:

$ pip3.9 install --upgrade pip
Requirement already satisfied: pip in /Users/ilarionov/.asdf/installs/python/3.9.21/lib/python3.9/site-packages (23.0.1)
/Users/ilarionov/.asdf/plugins/python/shims/pip: line 53: 33991 Segmentation fault: 11  "$pip" "$@"

$ lldb -- ~/.asdf/installs/python/3.9.21/bin/python3.9 -m pip install pip
(lldb) target create "/Users/ilarionov/.asdf/installs/python/3.9.21/bin/python3.9"
Current executable set to '/Users/ilarionov/.asdf/installs/python/3.9.21/bin/python3.9' (arm64).
(lldb) settings set -- target.run-args  "-m" "pip" "install" "pip"
(lldb) run
Process 32537 launched: '/Users/ilarionov/.asdf/installs/python/3.9.21/bin/python3.9' (arm64)
Requirement already satisfied: pip in /Users/ilarionov/.asdf/installs/python/3.9.21/lib/python3.9/site-packages (23.0.1)
Process 32537 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x180f9f2b8fbab048)
    frame #0: 0x000000026de10614 libssl.48.dylib`SSL_get_peer_certificate + 28
libssl.48.dylib`SSL_get_peer_certificate:
->  0x26de10614 <+28>: ldr    x19, [x8, #0x80]
    0x26de10618 <+32>: cbz    x19, 0x26de10640 ; <+72>
    0x26de1061c <+36>: add    x0, x19, #0x1c
    0x26de10620 <+40>: adrp   x3, 34
Target 0: (python3.9) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x180f9f2b8fbab048)
  * frame #0: 0x000000026de10614 libssl.48.dylib`SSL_get_peer_certificate + 28
    frame #1: 0x000000010073e764 _ssl.cpython-39-darwin.so`_ssl__SSLSocket_getpeercert + 108

$ otool -L ~/.asdf/installs/python/3.9.21/lib/python3.9/lib-dynload/_ssl.cpython-39-darwin.so
/Users/ilarionov/.asdf/installs/python/3.9.21/lib/python3.9/lib-dynload/_ssl.cpython-39-darwin.so:
	/opt/homebrew/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
	/opt/homebrew/opt/openssl@3/lib/libcrypto.3.dylib (compatibility version 3.0.0, current version 3.0.0)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)

Not sure if related but SSL_get_peer_certificate was deprecated recently: openssl/openssl#24296

CPython versions tested on:

3.9

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

Python 3.9.21 (main, Dec 9 2024, 13:17:33) [Clang 16.0.0 (clang-1600.0.26.4)]

[ned-deily]

FWIW, I am not able to reproduce this behavior on a Apple Silicon Mac running macOS 15.1.1 using the current openssl 3.4.0 from Homebrew, either with using the Homebrew-provided python@3.9 which currently seems to include pip 24.3.1, nor with building 3.9.21 from source and linking with the current Homebrew OpenSSL 3.4.0 then running pip installs and also python3.9 -m test -uall test_ssl. You seem to be using asdf based on the paths, something have no experience with, but perhaps it is getting in the way?

[xeron]

Yeah tested a bit more:

• Can't reproduce with python 3.9 from homebrew
• Can't reproduce with python 3.11 and 3.13 from asdf

FWIW asdf uses python-build from pyenv under the hood.

Reported to asdf-python – asdf-community/asdf-python#195.

[xeron]

Found a possible issue and a workaround. This fixes the segfault for me:

PYTHON_CONFIGURE_OPTS="--with-openssl=$(brew --prefix openssl)" asdf install python 3.9.21

I think the problem comes from pyenv trying to use openssl 1.1 but python ssl lib linking with openssl 3:

https://github.com/pyenv/pyenv/blob/master/plugins/python-build/share/python-build/3.9.21#L1

$ otool -L ~/.asdf/installs/python/3.9.21/lib/python3.9/lib-dynload/_ssl.cpython-39-darwin.so
/Users/ilarionov/.asdf/installs/python/3.9.21/lib/python3.9/lib-dynload/_ssl.cpython-39-darwin.so:
	/opt/homebrew/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
	/opt/homebrew/opt/openssl@3/lib/libcrypto.3.dylib (compatibility version 3.0.0, current version 3.0.0)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)