https://github.com/python/cpython/commit/7e102ecfe8402ee0270aa6610ff9b7dfe49cceb7 commit: 7e102ecfe8402ee0270aa6610ff9b7dfe49cceb7 branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: picnixz <[email protected]> date: 2026-10-21T21:39:31Z summary:
[3.15] gh-155833: GC-untrack MD5/SHA* objects before freeing the HACL* state (GH-155834) (#159789) gh-155833: GC-untrack MD5/SHA* objects before freeing the HACL* state (GH-155834) (cherry picked from commit 29fd3b8b0988d540e5b679667947523f6039da6c) Co-authored-by: Bénédikt Tran <[email protected]> files: A Misc/NEWS.d/next/Library/2026-08-15-12-08-33.gh-issue-155833.Pi2Yjp.rst M Modules/md5module.c M Modules/sha1module.c M Modules/sha2module.c M Modules/sha3module.c diff --git a/Misc/NEWS.d/next/Library/2026-08-15-12-08-33.gh-issue-155833.Pi2Yjp.rst b/Misc/NEWS.d/next/Library/2026-08-15-12-08-33.gh-issue-155833.Pi2Yjp.rst new file mode 100644 index 00000000000000..96bf5de44bd836 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-08-15-12-08-33.gh-issue-155833.Pi2Yjp.rst @@ -0,0 +1,2 @@ +Ensure that MD5 and SHA* objects are properly GC-untracked before freeing +their internal HACL* state. Patch by Bénédikt Tran. diff --git a/Modules/md5module.c b/Modules/md5module.c index 063be1405dd51f..537fbc096b3112 100644 --- a/Modules/md5module.c +++ b/Modules/md5module.c @@ -77,6 +77,7 @@ newMD5object(MD5State * st) return NULL; } HASHLIB_INIT_MUTEX(md5); + md5->hash_state = NULL; // PyObject_GC_New() does not zero memory PyObject_GC_Track(md5); return md5; @@ -86,13 +87,13 @@ newMD5object(MD5State * st) static void MD5_dealloc(PyObject *op) { + PyTypeObject *tp = Py_TYPE(op); + PyObject_GC_UnTrack(op); MD5object *ptr = _MD5object_CAST(op); if (ptr->hash_state != NULL) { Hacl_Hash_MD5_free(ptr->hash_state); ptr->hash_state = NULL; } - PyTypeObject *tp = Py_TYPE(op); - PyObject_GC_UnTrack(ptr); PyObject_GC_Del(ptr); Py_DECREF(tp); } diff --git a/Modules/sha1module.c b/Modules/sha1module.c index 5681780b569b6c..28fb73605f3f51 100644 --- a/Modules/sha1module.c +++ b/Modules/sha1module.c @@ -75,6 +75,7 @@ newSHA1object(SHA1State *st) return NULL; } HASHLIB_INIT_MUTEX(sha); + sha->hash_state = NULL; // PyObject_GC_New() does not zero memory PyObject_GC_Track(sha); return sha; @@ -85,13 +86,13 @@ newSHA1object(SHA1State *st) static void SHA1_dealloc(PyObject *op) { + PyTypeObject *tp = Py_TYPE(op); + PyObject_GC_UnTrack(op); SHA1object *ptr = _SHA1object_CAST(op); if (ptr->hash_state != NULL) { Hacl_Hash_SHA1_free(ptr->hash_state); ptr->hash_state = NULL; } - PyTypeObject *tp = Py_TYPE(ptr); - PyObject_GC_UnTrack(ptr); PyObject_GC_Del(ptr); Py_DECREF(tp); } diff --git a/Modules/sha2module.c b/Modules/sha2module.c index 7613ee54954dd6..d3801f2b4d232d 100644 --- a/Modules/sha2module.c +++ b/Modules/sha2module.c @@ -146,6 +146,7 @@ newSHA384object(sha2_state *state) return NULL; } HASHLIB_INIT_MUTEX(sha); + sha->state = NULL; // PyObject_GC_New() does not zero memory PyObject_GC_Track(sha); return sha; @@ -159,6 +160,7 @@ newSHA512object(sha2_state *state) return NULL; } HASHLIB_INIT_MUTEX(sha); + sha->state = NULL; // PyObject_GC_New() does not zero memory PyObject_GC_Track(sha); return sha; @@ -168,13 +170,13 @@ newSHA512object(sha2_state *state) static void SHA256_dealloc(PyObject *op) { + PyTypeObject *tp = Py_TYPE(op); + PyObject_GC_UnTrack(op); SHA256object *ptr = _SHA256object_CAST(op); if (ptr->state != NULL) { Hacl_Hash_SHA2_free_256(ptr->state); ptr->state = NULL; } - PyTypeObject *tp = Py_TYPE(ptr); - PyObject_GC_UnTrack(ptr); PyObject_GC_Del(ptr); Py_DECREF(tp); } @@ -182,13 +184,13 @@ SHA256_dealloc(PyObject *op) static void SHA512_dealloc(PyObject *op) { + PyTypeObject *tp = Py_TYPE(op); + PyObject_GC_UnTrack(op); SHA512object *ptr = _SHA512object_CAST(op); if (ptr->state != NULL) { Hacl_Hash_SHA2_free_512(ptr->state); ptr->state = NULL; } - PyTypeObject *tp = Py_TYPE(ptr); - PyObject_GC_UnTrack(ptr); PyObject_GC_Del(ptr); Py_DECREF(tp); } diff --git a/Modules/sha3module.c b/Modules/sha3module.c index 3f694238de8654..f0cb60d04caac7 100644 --- a/Modules/sha3module.c +++ b/Modules/sha3module.c @@ -102,6 +102,7 @@ newSHA3object(PyTypeObject *type) return NULL; } HASHLIB_INIT_MUTEX(newobj); + newobj->hash_state = NULL; // PyObject_GC_New() does not zero memory newobj->digest_size = newobj->block_size = 0; PyObject_GC_Track(newobj); return newobj; @@ -234,7 +235,7 @@ SHA3_dealloc(PyObject *self) PyTypeObject *tp = Py_TYPE(self); PyObject_GC_UnTrack(self); (void)SHA3_clear(self); - tp->tp_free(self); + PyObject_GC_Del(self); Py_DECREF(tp); } _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
