[3.13] gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843) (#144859)
gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843) In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self) was called before _setSSLError(get_state_ctx(self), ...), causing a use-after-free. Additionally, get_state_ctx() was called with self (PySSLSocket*) instead of sslctx (PySSLContext*), which is a type confusion bug. Fix by calling _setSSLError() before Py_DECREF() and using sslctx instead of self for get_state_ctx(). (cherry picked from commit c91638ca0671b8038831f963ed44e66cdda006a2) Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
M
Miss Islington (bot) committed
37f818caef77ac78328094ea2b815788374adf06
Parent: e1dbe22
Committed by GitHub <noreply@github.com>
on 2/16/2026, 3:09:58 AM