[Python-checkins] cpython (3.3): Issue #18747: Use a parent atfork handler instead of a child atfork handler.
christian.heimes
python-checkins at python.org
Thu Aug 22 13:24:13 CEST 2013
http://hg.python.org/cpython/rev/39c9dbed3aa1
changeset: 85314:39c9dbed3aa1
branch: 3.3
parent: 85310:64e004737837
user: Christian Heimes <christian at cheimes.de>
date: Thu Aug 22 13:19:48 2013 +0200
summary:
Issue #18747: Use a parent atfork handler instead of a child atfork handler.
fork() is suppose to be async-signal safe but the handler calls unsafe functions. A parent handler mitigates the issue.
files:
Modules/_ssl.c | 21 +++++++++------------
1 files changed, 9 insertions(+), 12 deletions(-)
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -2585,23 +2585,25 @@
/* Seed OpenSSL's PRNG at fork(), http://bugs.python.org/issue18747
*
- * The child handler seeds the PRNG from pseudo-random data like pid, the
- * current time (nanoseconds, miliseconds or seconds) and an uninitialized
- * array. The array contains stack variables that are impossible to predict
+ * The parent handler seeds the PRNG from pseudo-random data like pid, the
+ * current time (miliseconds or seconds) and an uninitialized arry.
+ * The array contains stack variables that are impossible to predict
* on most systems, e.g. function return address (subject to ASLR), the
* stack protection canary and automatic variables.
* The code is inspired by Apache's ssl_rand_seed() function.
*
* Note:
* The code uses pthread_atfork() until Python has a proper atfork API. The
- * handlers are not removed from the child process.
+ * handlers are not removed from the child process. A parent handler is used
+ * instead of a child handler because fork() is suppose to be async-signal
+ * safe but the handler calls unsafe functions.
*/
#if defined(HAVE_PTHREAD_ATFORK) && defined(WITH_THREAD)
#define PYSSL_RAND_ATFORK 1
static void
-PySSL_RAND_atfork_child(void)
+PySSL_RAND_atfork_parent(void)
{
struct {
char stack[128]; /* uninitialized (!) stack data, 128 is an
@@ -2615,11 +2617,6 @@
#endif
seed.pid = getpid();
_PyTime_gettimeofday(&(seed.tp));
-
-#if 0
- fprintf(stderr, "PySSL_RAND_atfork_child() seeds %i bytes in pid %i\n",
- (int)sizeof(seed), seed.pid);
-#endif
RAND_add((unsigned char *)&seed, sizeof(seed), 0.0);
}
@@ -2633,8 +2630,8 @@
return 0;
retval = pthread_atfork(NULL, /* prepare */
- NULL, /* parent */
- PySSL_RAND_atfork_child); /* child */
+ PySSL_RAND_atfork_parent, /* parent */
+ NULL); /* child */
if (retval != 0) {
PyErr_SetFromErrno(PyExc_OSError);
return -1;
--
Repository URL: http://hg.python.org/cpython
More information about the Python-checkins
mailing list