[issue29340] SSL destructor segfaults in python3.6 threads when an unverified-cert connection is closed

Christian Heimes added the comment: It's a bug in OpenSSL. There isn't much we can do about it. I'm closing the issue as 3rd party issue. -- resolution: -> third party stage: -> resolved status: open -> closed ___ Python tracker

[issue29340] SSL destructor segfaults in python3.6 threads when an unverified-cert connection is closed

Nick Sweeting added the comment: Actually I suspected it was OpenSSL first, I filed the report on their github issues, then went on a fun little wild goose chase that ended in the CPython issue tracker. :) https://github.com/openssl/openssl/issues/2260 Thanks for helping debug this so quickly

[issue29340] SSL destructor segfaults in python3.6 threads when an unverified-cert connection is closed

Christian Heimes added the comment: I can't reproduce the crash with OpenSSL 1.1.0 and LibreSSL 2.5.0. You might have found a bug in OpenSSL. -- ___ Python tracker ___ _

[issue29340] SSL destructor segfaults in python3.6 threads when an unverified-cert connection is closed

Christian Heimes added the comment: SSL_CTX_free: if (a->rbuf_freelist) ssl_buf_freelist_free(a->rbuf_freelist); (gdb) p list $1 = (SSL3_BUF_FREELIST *) 0x7fffe8003b50 (gdb) p *list $2 = {chunklen = 33096, len = 1, head = 0x7fffe8031c00} (gdb) p *list->head $3 = {next = 0x530317

[issue29340] SSL destructor segfaults in python3.6 threads when an unverified-cert connection is closed

Christian Heimes added the comment: I can reproduce the crash under Linux with OpenSSL 1.0.2j and Python 2.7, 3.5 and 3.6. Python 2.7 doesn't crash every time, 1 out of 5 times maybe. #0 ssl_buf_freelist_free (list=0x7fffe8003b50) at ssl_lib.c:2094 #1 0x7fffef3d68d7 in SSL_CTX_free (a=0x7

[issue29340] SSL destructor segfaults in python3.6 threads when an unverified-cert connection is closed

New submission from Nick Sweeting: I mistakenly thought this bug was a pyOpenSSL bug, so I reported it there (https://github.com/pyca/pyopenssl/issues/588), but it looks like this is actually a bug in CPython. See the link for a nicer formatted bug report with more details. Code to reproduce: