Skip to content

Commit 65fb2c0

Browse files
bpo-339827: Do not swallow exceptions in the _ssl module. (GH-12756)
1 parent 530f506 commit 65fb2c0

File tree

1 file changed

+52
-37
lines changed

1 file changed

+52
-37
lines changed

Modules/_ssl.c

Lines changed: 52 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -590,19 +590,18 @@ fill_and_set_sslerror(PySSLSocket *sslsock, PyObject *type, int ssl_errno,
590590
key = Py_BuildValue("ii", lib, reason);
591591
if (key == NULL)
592592
goto fail;
593-
reason_obj = PyDict_GetItem(err_codes_to_names, key);
593+
reason_obj = PyDict_GetItemWithError(err_codes_to_names, key);
594594
Py_DECREF(key);
595-
if (reason_obj == NULL) {
596-
/* XXX if reason < 100, it might reflect a library number (!!) */
597-
PyErr_Clear();
595+
if (reason_obj == NULL && PyErr_Occurred()) {
596+
goto fail;
598597
}
599598
key = PyLong_FromLong(lib);
600599
if (key == NULL)
601600
goto fail;
602-
lib_obj = PyDict_GetItem(lib_codes_to_names, key);
601+
lib_obj = PyDict_GetItemWithError(lib_codes_to_names, key);
603602
Py_DECREF(key);
604-
if (lib_obj == NULL) {
605-
PyErr_Clear();
603+
if (lib_obj == NULL && PyErr_Occurred()) {
604+
goto fail;
606605
}
607606
if (errstr == NULL)
608607
errstr = ERR_reason_error_string(errcode);
@@ -3682,7 +3681,7 @@ _pwinfo_set(_PySSLPasswordInfo *pw_info, PyObject* password,
36823681
Py_ssize_t size;
36833682

36843683
if (PyUnicode_Check(password)) {
3685-
password_bytes = PyUnicode_AsEncodedString(password, NULL, NULL);
3684+
password_bytes = PyUnicode_AsUTF8String(password);
36863685
if (!password_bytes) {
36873686
goto error;
36883687
}
@@ -3787,13 +3786,17 @@ _ssl__SSLContext_load_cert_chain_impl(PySSLContext *self, PyObject *certfile,
37873786
if (keyfile == Py_None)
37883787
keyfile = NULL;
37893788
if (!PyUnicode_FSConverter(certfile, &certfile_bytes)) {
3790-
PyErr_SetString(PyExc_TypeError,
3791-
"certfile should be a valid filesystem path");
3789+
if (PyErr_ExceptionMatches(PyExc_TypeError)) {
3790+
PyErr_SetString(PyExc_TypeError,
3791+
"certfile should be a valid filesystem path");
3792+
}
37923793
return NULL;
37933794
}
37943795
if (keyfile && !PyUnicode_FSConverter(keyfile, &keyfile_bytes)) {
3795-
PyErr_SetString(PyExc_TypeError,
3796-
"keyfile should be a valid filesystem path");
3796+
if (PyErr_ExceptionMatches(PyExc_TypeError)) {
3797+
PyErr_SetString(PyExc_TypeError,
3798+
"keyfile should be a valid filesystem path");
3799+
}
37973800
goto error;
37983801
}
37993802
if (password && password != Py_None) {
@@ -3985,22 +3988,44 @@ _ssl__SSLContext_load_verify_locations_impl(PySSLContext *self,
39853988
goto error;
39863989
}
39873990
if (cafile && !PyUnicode_FSConverter(cafile, &cafile_bytes)) {
3988-
PyErr_SetString(PyExc_TypeError,
3989-
"cafile should be a valid filesystem path");
3991+
if (PyErr_ExceptionMatches(PyExc_TypeError)) {
3992+
PyErr_SetString(PyExc_TypeError,
3993+
"cafile should be a valid filesystem path");
3994+
}
39903995
goto error;
39913996
}
39923997
if (capath && !PyUnicode_FSConverter(capath, &capath_bytes)) {
3993-
PyErr_SetString(PyExc_TypeError,
3994-
"capath should be a valid filesystem path");
3998+
if (PyErr_ExceptionMatches(PyExc_TypeError)) {
3999+
PyErr_SetString(PyExc_TypeError,
4000+
"capath should be a valid filesystem path");
4001+
}
39954002
goto error;
39964003
}
39974004

39984005
/* validata cadata type and load cadata */
39994006
if (cadata) {
4000-
Py_buffer buf;
4001-
PyObject *cadata_ascii = NULL;
4002-
4003-
if (PyObject_GetBuffer(cadata, &buf, PyBUF_SIMPLE) == 0) {
4007+
if (PyUnicode_Check(cadata)) {
4008+
PyObject *cadata_ascii = PyUnicode_AsASCIIString(cadata);
4009+
if (cadata_ascii == NULL) {
4010+
if (PyErr_ExceptionMatches(PyExc_UnicodeEncodeError)) {
4011+
goto invalid_cadata;
4012+
}
4013+
goto error;
4014+
}
4015+
r = _add_ca_certs(self,
4016+
PyBytes_AS_STRING(cadata_ascii),
4017+
PyBytes_GET_SIZE(cadata_ascii),
4018+
SSL_FILETYPE_PEM);
4019+
Py_DECREF(cadata_ascii);
4020+
if (r == -1) {
4021+
goto error;
4022+
}
4023+
}
4024+
else if (PyObject_CheckBuffer(cadata)) {
4025+
Py_buffer buf;
4026+
if (PyObject_GetBuffer(cadata, &buf, PyBUF_SIMPLE)) {
4027+
goto error;
4028+
}
40044029
if (!PyBuffer_IsContiguous(&buf, 'C') || buf.ndim > 1) {
40054030
PyBuffer_Release(&buf);
40064031
PyErr_SetString(PyExc_TypeError,
@@ -4013,23 +4038,13 @@ _ssl__SSLContext_load_verify_locations_impl(PySSLContext *self,
40134038
if (r == -1) {
40144039
goto error;
40154040
}
4016-
} else {
4017-
PyErr_Clear();
4018-
cadata_ascii = PyUnicode_AsASCIIString(cadata);
4019-
if (cadata_ascii == NULL) {
4020-
PyErr_SetString(PyExc_TypeError,
4021-
"cadata should be an ASCII string or a "
4022-
"bytes-like object");
4023-
goto error;
4024-
}
4025-
r = _add_ca_certs(self,
4026-
PyBytes_AS_STRING(cadata_ascii),
4027-
PyBytes_GET_SIZE(cadata_ascii),
4028-
SSL_FILETYPE_PEM);
4029-
Py_DECREF(cadata_ascii);
4030-
if (r == -1) {
4031-
goto error;
4032-
}
4041+
}
4042+
else {
4043+
invalid_cadata:
4044+
PyErr_SetString(PyExc_TypeError,
4045+
"cadata should be an ASCII string or a "
4046+
"bytes-like object");
4047+
goto error;
40334048
}
40344049
}
40354050

0 commit comments

Comments
 (0)