Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[3.11] gh-114572: Fix locking in cert_store_stats and get_ca_certs (GH-114573) #115549

Merged
merged 1 commit into from
Feb 20, 2024
Merged

[3.11] gh-114572: Fix locking in cert_store_stats and get_ca_certs (GH-114573) #115549

merged 1 commit into from
Feb 20, 2024

Commits on Feb 16, 2024

  1. pythongh-114572: Fix locking in cert_store_stats and get_ca_certs (py… 

    …thonGH-114573)

* pythongh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
    @davidben @miss-islington
    davidben authored and miss-islington committed Feb 16, 2024
    Configuration menu
    Copy the full SHA
    fa5c6d1 View commit details
    Browse the repository at this point in the history