[issue27305] Crash with "pip list --outdated" on Windows 10 with Python 2.7.12rc1

[Eryk Sun]

Eryk Sun added the comment:

I get an access violation due to calling the ASN1_ITEM pointer as a function:

    >  810:                              ASN1_ITEM_ptr(method->it)));
    _ssl!_get_peer_alt_names+0x12a:
    00007ffe`17b1225a ffd0            call    rax
                                      {_ssl!GENERAL_NAMES_it
                                       (00007ffe`17ca0c20)}

    0:000> ?? (ASN1_ITEM *)@rax
    struct ASN1_ITEM_st * 0x00007ffe`17ca0c20
       +0x000 itype            : 0 ''
       +0x004 utype            : 0n-1
       +0x008 templates        : 0x00007ffe`17ca0c00 ASN1_TEMPLATE_st
       +0x010 tcount           : 0n0
       +0x018 funcs            : (null)
       +0x020 size             : 0n0
       +0x028 sname            : 0x00007ffe`17cb5bf8  "GENERAL_NAMES"

I know very little about OpenSSL or the _ssl module, but I think the default on Windows is to define OPENSSL_EXPORT_VAR_AS_FUNCTION, in which case:

    /*
     * Platforms that can't easily handle shared global variables
     * are declared as functions returning ASN1_ITEM pointers.
     */

    /* Macro to obtain ASN1_ITEM pointer from exported type */
    #  define ASN1_ITEM_ptr(iptr) (iptr())


The 2.7.10 build uses a function pointer:

    >  810:                              ASN1_ITEM_ptr(method->it)));
        _ssl!_get_peer_alt_names+0xe8:
        00000000`02681c78 ffd0            call    rax
                                          {_ssl!GENERAL_NAMES_it
                                           (00000000`0269a730)}

        0:000> u _ssl!GENERAL_NAMES_it l2
        _ssl!GENERAL_NAMES_it
            [c:\build27\cpython\externals\openssl-1.0.2a\
                crypto\x509v3\v3_genn.c @ 99]:
        00000000`0269a730 488d05b93a1400  lea     rax,
                                          [_ssl!local_it
                                           (00000000`027de1f0)]
        00000000`0269a737 c3              ret

        0:000> p
        >  810:                              ASN1_ITEM_ptr(method->it)));
        _ssl!_get_peer_alt_names+0xea:
        00000000`02681c7a 488d942488080000 lea     rdx,[rsp+888h]

        0:000> ?? (ASN1_ITEM *)@rax
        struct ASN1_ITEM_st * 0x00000000`027de1f0
           +0x000 itype            : 0 ''
           +0x004 utype            : 0n-1
           +0x008 templates        : 0x00000000`027de1d0 ASN1_TEMPLATE_st
           +0x010 tcount           : 0n0
           +0x018 funcs            : (null)
           +0x020 size             : 0n0
           +0x028 sname            : 0x00000000`0284aa30  "GENERAL_NAMES"

Except _ssl links to OpenSSL statically, so strictly speaking this shouldn't be necessary. The 3.5 build uses a global variable here instead of a function pointer:

    >  847:         if(!(method = X509V3_EXT_get(ext))) {
    _ssl_d!_get_peer_alt_names+0xe9:
    00007ffe`178398d9 e88faafaff      call    _ssl_d!ILT+13160(X509V3_EXT_get) 
                                              (00007ffe`177e436d)
    0:000> p
    >  847:         if(!(method = X509V3_EXT_get(ext))) {
    _ssl_d!_get_peer_alt_names+0xee:
    00007ffe`178398de 48898424d8000000 mov     qword ptr [rsp+0D8h],rax 
                                               ss:00000076`f99eabe8=
                                               00007ffe359475b0
    0:000> ?? ((X509V3_EXT_METHOD *)@rax)->it
    struct ASN1_ITEM_st * 0x00007ffe`17a55b10
       +0x000 itype            : 0 ''
       +0x004 utype            : 0n-1
       +0x008 templates        : 0x00007ffe`17a55af0 ASN1_TEMPLATE_st
       +0x010 tcount           : 0n0
       +0x018 funcs            : (null)
       +0x020 size             : 0n0
       +0x028 sname            : 0x00007ffe`17a55d58  "GENERAL_NAMES"

----------
nosy: +eryksun

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue27305>
_______________________________________