https://github.com/python/cpython/commit/3421009570b5f7502d26695022ef1bdbd3642721 commit: 3421009570b5f7502d26695022ef1bdbd3642721 branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: picnixz <[email protected]> date: 2026-10-20T18:59:34Z summary:
[3.15] gh-159811: Raise OpenSSL errors in `_hashlib.HMAC` after re-attaching the thread state (GH-159818) (#159926) gh-159811: Raise OpenSSL errors in `_hashlib.HMAC` after re-attaching the thread state (GH-159818) `hashlib_openssl_HMAC_update_once()` set an exception when the OpenSSL HMAC update function failed, but it was called inside a GIL-released region and the object's mutex held by `_hashlib.HMAC.update()` and `_hashlib.hmac_new()` when the data exceeds `HASHLIB_GIL_MINSIZE` bytes. Instead, the HMAC update function is called directly in `_hmac_update()`, and the exception is set once the thread state is re-attached and the mutex is released (restores the behavior prior to gh-134531). Since the OpenSSL error queue is per thread, the exception type and message are unaffected. (cherry picked from commit b4b81e1b205ff1e88d5add0fcb050ed5162e4eca) Co-authored-by: Bénédikt Tran <[email protected]> files: A Misc/NEWS.d/next/Library/2026-10-19-23-25-29.gh-issue-159811.P6yy0z.rst M Modules/_hashopenssl.c diff --git a/Misc/NEWS.d/next/Library/2026-10-19-23-25-29.gh-issue-159811.P6yy0z.rst b/Misc/NEWS.d/next/Library/2026-10-19-23-25-29.gh-issue-159811.P6yy0z.rst new file mode 100644 index 00000000000000..bcd76f209e5264 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-19-23-25-29.gh-issue-159811.P6yy0z.rst @@ -0,0 +1,3 @@ +Fix a crash in :mod:`hmac` when the OpenSSL routine used by +:meth:`hmac.HMAC.update` or by :func:`hmac.new` fails on data larger +than 2048 bytes. Patch by Bénédikt Tran. diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c index f895c9037485c4..cc6076f94731a6 100644 --- a/Modules/_hashopenssl.c +++ b/Modules/_hashopenssl.c @@ -1975,16 +1975,6 @@ hashlib_HMAC_get_hashlib_digest_name(HMACobject *self) #endif } -static int -hashlib_openssl_HMAC_update_once(PY_HMAC_CTX_TYPE *ctx, const Py_buffer *v) -{ - if (!PY_HMAC_update(ctx, (const unsigned char *)v->buf, (size_t)v->len)) { - notify_smart_ssl_error_occurred_in(Py_STRINGIFY(PY_HMAC_update)); - return -1; - } - return 0; -} - /* Thin wrapper around PY_HMAC_CTX_free that allows to pass a NULL 'ctx'. */ static inline void hashlib_openssl_HMAC_CTX_free(PY_HMAC_CTX_TYPE *ctx) @@ -2239,10 +2229,15 @@ _hmac_update(HMACobject *self, PyObject *obj) GET_BUFFER_VIEW_OR_ERROR(obj, &view, return -1); HASHLIB_EXTERNAL_INSTRUCTIONS_LOCKED( self, view.len, - r = hashlib_openssl_HMAC_update_once(self->ctx, &view) + r = PY_HMAC_update(self->ctx, (const unsigned char *)view.buf, + (size_t)view.len) ); PyBuffer_Release(&view); - return r; + if (r == 0) { + notify_smart_ssl_error_occurred_in(Py_STRINGIFY(PY_HMAC_update)); + return -1; + } + return 0; } /*[clinic input] _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
