gh-155782: avoid a crash in ssl.SSLObject.group for session-less objects

Author: picnixz

Lib/test/test_ssl.py

@@ -1097,6 +1097,15 @@ def test_set_server_sigalgs(self):
         if CAN_IGNORE_UNKNOWN_OPENSSL_SIGALGS:
             self.assertIsNone(ctx.set_server_sigalgs('rsa_pss_rsae_sha256:?foo'))
 
+    @unittest.skipUnless(CAN_GET_SELECTED_OPENSSL_GROUP,
+                         "SSL library doesn't support getting selected group")
+    def test_no_session_group_does_not_crash(self):
+        # Ensure that .group() does not crash because of OpenSSL itself.
+        # See https://github.com/python/cpython/issues/155782.
+        ctx = ssl.create_default_context()
+        obj = ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
+        self.assertIsNone(obj.group())
+
     def test_options(self):
         # Test default SSLContext options
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst

@@ -0,0 +1,2 @@
+:mod:`ssl`: prevent a crash in :meth:`SSLObject.group <ssl.SSLObject.group>`
+for session-less objects on OpenSSL 3.2 and later. Patch by Bénédikt Tran.

Modules/_ssl.c

@@ -2224,7 +2224,9 @@ _ssl__SSLSocket_group_impl(PySSLSocket *self)
 #if OPENSSL_VERSION_NUMBER >= 0x30200000L
     const char *group_name;
 
-    if (self->ssl == NULL) {
+    // OpenSSL issue: SSL_get0_group_name(...) crashes if no session exists.
+    // See https://github.com/openssl/openssl/issues/32379.
+    if (self->ssl == NULL || SSL_get_session(self->ssl) == NULL) {
         Py_RETURN_NONE;
     }
     group_name = SSL_get0_group_name(self->ssl);