https://github.com/python/cpython/commit/0405f1003fb61a9502c7fbb896cc26a1409d4711 commit: 0405f1003fb61a9502c7fbb896cc26a1409d4711 branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: picnixz <[email protected]> date: 2026-10-20T12:47:22-07:00 summary:
[3.15] gh-159811: Raise OpenSSL errors in `_hashlib.HASH` after re-attaching the thread state (GH-159817) (#159927) gh-159811: Raise OpenSSL errors in `_hashlib.HASH` after re-attaching the thread state (GH-159817) When `EVP_DigestUpdate()` failed, `_hashlib_HASH_hash()` raised a Python exception, however, `_hashlib.HASH.update()` and the `_hashlib.HASH` constructor release the GIL before calling it when the data is larger than `HASHLIB_GIL_MINSIZE` bytes. `_hashlib_HASH_hash()` now only returns an error status and its callers raise the exception once they have re-attached the thread state. (cherry picked from commit 6fa2d645ea57120d1cbf38b45fc8ee2b5019090b) Co-authored-by: Bénédikt Tran <[email protected]> files: A Misc/NEWS.d/next/Library/2026-10-19-23-25-29.gh-issue-159811.cMB4DO.rst M Modules/_hashopenssl.c diff --git a/Misc/NEWS.d/next/Library/2026-10-19-23-25-29.gh-issue-159811.cMB4DO.rst b/Misc/NEWS.d/next/Library/2026-10-19-23-25-29.gh-issue-159811.cMB4DO.rst new file mode 100644 index 00000000000000..f63cd928a6a33c --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-19-23-25-29.gh-issue-159811.cMB4DO.rst @@ -0,0 +1,3 @@ +Fix a crash in :mod:`hashlib` when the OpenSSL routine used by +:meth:`hash.update() <hashlib.hash.update>` or by hash object constructors +fails on data larger than 2048 bytes. Patch by Bénédikt Tran. diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c index cc6076f94731a6..aae12802d33254 100644 --- a/Modules/_hashopenssl.c +++ b/Modules/_hashopenssl.c @@ -846,6 +846,12 @@ new_hash_object(PyTypeObject *type) return retval; } +/* + * Update the digest context of 'self' with 'len' bytes from 'vp'. + * + * Return 0 on success and -1 if EVP_DigestUpdate() failed. No exception + * is set, so that this can be called without an attached thread state. + */ static int _hashlib_HASH_hash(HASHobject *self, const void *vp, Py_ssize_t len) { @@ -857,7 +863,6 @@ _hashlib_HASH_hash(HASHobject *self, const void *vp, Py_ssize_t len) else process = Py_SAFE_DOWNCAST(len, Py_ssize_t, unsigned int); if (!EVP_DigestUpdate(self->ctx, (const void*)cp, process)) { - notify_ssl_error_occurred_in(Py_STRINGIFY(EVP_DigestUpdate)); return -1; } len -= process; @@ -990,7 +995,11 @@ _hashlib_HASH_update_impl(HASHobject *self, PyObject *obj) result = _hashlib_HASH_hash(self, view.buf, view.len) ); PyBuffer_Release(&view); - return result < 0 ? NULL : Py_None; + if (result < 0) { + notify_ssl_error_occurred_in(Py_STRINGIFY(EVP_DigestUpdate)); + return NULL; + } + Py_RETURN_NONE; } static PyMethodDef HASH_methods[] = { @@ -1304,7 +1313,7 @@ _hashlib_HASH(_hashlibstate *state, const char *digestname, PyObject *data_obj, result = _hashlib_HASH_hash(self, view.buf, view.len) ); if (result == -1) { - assert(PyErr_Occurred()); + notify_ssl_error_occurred_in(Py_STRINGIFY(EVP_DigestUpdate)); Py_CLEAR(self); goto exit; } _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
