bpo-43789: OpenSSL 3.0.0 Don't call passwd callback again in error ca…

…se (pythonGH-25303)
tiran · Apr 9, 2021 · d3b73f3 · d3b73f3
1 parent bd88ccb
commit d3b73f3
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/Misc/NEWS.d/next/Library/2021-04-09-14-08-03.bpo-43789.eaHlAm.rst b/Misc/NEWS.d/next/Library/2021-04-09-14-08-03.bpo-43789.eaHlAm.rst
@@ -0,0 +1,2 @@
+OpenSSL 3.0.0: Don't call the password callback function a second time when
+first call has signaled an error condition.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
@@ -3926,6 +3926,13 @@ _password_callback(char *buf, int size, int rwflag, void *userdata)
 
     PySSL_END_ALLOW_THREADS_S(pw_info->thread_state);
 
+    if (pw_info->error) {
+        /* already failed previously. OpenSSL 3.0.0-alpha14 invokes the
+         * callback multiple times which can lead to fatal Python error in
+         * exception check. */
+        goto error;
+    }
+
     if (pw_info->callable) {
         fn_ret = _PyObject_CallNoArg(pw_info->callable);
         if (!fn_ret) {
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		OpenSSL 3.0.0: Don't call the password callback function a second time when
		first call has signaled an error condition.