[3.6] bpo-30594: Fixed refcounting in newPySSLSocket (GH-1992) (#1994)
If pass a server_hostname= that fails IDNA decoding to SSLContext.wrap_socket or SSLContext.wrap_bio, then the SSLContext object had a spurious Py_DECREF called on it, eventually leading to segfaults.
(cherry picked from commit 65ece7ca2366308fa91a39a8dfa255e6bdce3cca)
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 2a2c18f..dbfbd44 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -599,6 +599,7 @@
self->ssl = NULL;
self->Socket = NULL;
self->ctx = sslctx;
+ Py_INCREF(sslctx);
self->shutdown_seen_zero = 0;
self->handshake_done = 0;
self->owner = NULL;
@@ -613,8 +614,6 @@
self->server_hostname = hostname;
}
- Py_INCREF(sslctx);
-
/* Make sure the SSL error state is initialized */
(void) ERR_get_state();
ERR_clear_error();