Free cert_array if it is *not* None
MODIFY
test/contrib/test_securetransport.py
test/contrib/test_securetransport.py
# -*- coding: utf-8 -*-
+import contextlib
+import socket
+import ssl
+
import pytest
try:
- from urllib3.contrib.securetransport import (inject_into_urllib3,
- extract_from_urllib3)
+ from urllib3.contrib.securetransport import (
+ WrappedSocket, inject_into_urllib3, extract_from_urllib3
+ )
except ImportError as e:
pytestmark = pytest.mark.skip('Could not import SecureTransport: %r' % e)
@@ -19,3 +24,10 @@ def setup_module():
def teardown_module():
extract_from_urllib3()
+
+
+def test_no_crash_with_empty_trust_bundle():
+ with contextlib.closing(socket.socket()) as s:
+ ws = WrappedSocket(s)
+ with pytest.raises(ssl.SSLError):
+ ws._custom_validate(True, b"")

MODIFY
urllib3/contrib/securetransport.py
urllib3/contrib/securetransport.py
@@ -399,7 +399,7 @@ class WrappedSocket(object):
if trust:
CoreFoundation.CFRelease(trust)
- if cert_array is None:
+ if cert_array is not None:
CoreFoundation.CFRelease(cert_array)
# Ok, now we can look at what the result was.

Free cert_array if it is *not* None (#1354)