Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-06-17 15:16:42 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.14] gh-145376: Fix crashes in md5module.c and hmacmodule.c (GH-145422) (#145610)

Browse source 
gh-145376: Fix crashes in `md5module.c` and `hmacmodule.c` (GH-145422)

Fix a possible NULL pointer dereference in `md5module.c` and a double-free in `hmacmodule.c`.
Those crashes only occur in error paths taken when the interpreter fails to allocate memory.
(cherry picked from commit c1d7768321)

Co-authored-by: Pieter Eendebak <pieter.eendebak@gmail.com>
This commit is contained in:
Miss Islington (bot) 2026-03-06 22:06:32 +01:00 • committed by GitHub
parent 6e5e4edfd2
commit c23dd527e0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Misc/NEWS.d/next/Library/2026-03-02-19-41-39.gh-issue-145376.OOzSOh.rst Normal file
View file

@ -0,0 +1,2 @@
Fix double free and null pointer dereference in unusual error scenarios
in :mod:`hashlib` and :mod:`hmac` modules.

4
Modules/hmacmodule.c
View file

@ -1529,7 +1529,6 @@ static void
py_hmac_hinfo_ht_free(void *hinfo)
{
py_hmac_hinfo *entry = (py_hmac_hinfo *)hinfo;
assert(entry->display_name != NULL);
if (--(entry->refcnt) == 0) {
Py_CLEAR(entry->display_name);
PyMem_Free(hinfo);
@ -1628,7 +1627,8 @@ py_hmac_hinfo_ht_new(void)
e->hashlib_name == NULL ? e->name : e->hashlib_name
);
if (value->display_name == NULL) {
PyMem_Free(value);
/* 'value' is owned by the table (refcnt > 0),
so _Py_hashtable_destroy() will free it. */
goto error;
}
}

5
Modules/md5module.c
View file

@ -87,7 +87,10 @@ static void
MD5_dealloc(PyObject *op)
{
MD5object *ptr = _MD5object_CAST(op);
Hacl_Hash_MD5_free(ptr->hash_state);
if (ptr->hash_state != NULL) {
Hacl_Hash_MD5_free(ptr->hash_state);
ptr->hash_state = NULL;
}
PyTypeObject *tp = Py_TYPE(op);
PyObject_GC_UnTrack(ptr);
PyObject_GC_Del(ptr);