From d9de9036cc65dfa4bbc1e7801b1daab79ab5d5f7 Mon Sep 17 00:00:00 2001 From: Jay Lee Date: Tue, 4 Aug 2026 10:37:38 -0400 Subject: [PATCH] fix(auth): use stable offset for SSL_CTX pointer extraction (Python 3.14) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #16976 replaced pyOpenSSL with stdlib ssl but changed the SSL_CTX* pointer offset formula from the stable: ctypes.sizeof(ctypes.c_void_p) * 2 to the fragile: sys.getsizeof(object()) Python 3.14 changed the PyObject header layout, causing sys.getsizeof(object()) to return a different value. This makes _cast_ssl_ctx_to_void_p_stdlib() read garbage memory, which is passed to OpenSSL as an SSL_CTX* → segfault during mTLS handshake. The standalone google-auth-library-python repo already had the correct formula. This commit restores it. Fixes segfault on Ubuntu 26.04 (Python 3.14) when using ECP mTLS offload. --- .../google/auth/transport/_custom_tls_signer.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/packages/google-auth/google/auth/transport/_custom_tls_signer.py b/packages/google-auth/google/auth/transport/_custom_tls_signer.py index 17a714ca5e70..02954f8b237f 100644 --- a/packages/google-auth/google/auth/transport/_custom_tls_signer.py +++ b/packages/google-auth/google/auth/transport/_custom_tls_signer.py @@ -60,7 +60,13 @@ def _cast_ssl_ctx_to_void_p_stdlib(context): "Custom TLS signing is only supported on standard release CPython runtimes." ) - offset = sys.getsizeof(object()) + # Use a stable offset to reach the SSL_CTX* inside CPython's + # PySSLContext struct. The previous formula + # sys.getsizeof(object()) + # broke on Python 3.14 because the PyObject header size changed. + # ctypes.sizeof(c_void_p) * 2 equals the ob_refcnt + ob_type + # header and is consistent across CPython versions. + offset = ctypes.sizeof(ctypes.c_void_p) * 2 return ctypes.c_void_p.from_address(id(context) + offset)