Repository navigation
Reference leaks in _hashlib.hmac_new and _hashlib.hmac_digest #130151
Description
Bug report
Bug description:
The following leaks:
def test_leak1(self):
import _hashlib
self.assertRaises(TypeError, _hashlib.hmac_new, b"key", 1, "sha256")The issue is in _hashlib_hmac_new_impl:
self = PyObject_New(HMACobject, type);
...
if ((msg_obj != NULL) && (msg_obj != Py_None)) {
if (!_hmac_update(self, msg_obj))
goto error;
}
return (PyObject*)self;
error:
if (ctx) HMAC_CTX_free(ctx);
if (self) PyObject_Free(self);
return NULL;More precisely, the issue is that we are only calling PyObject_Free(self) and we are not decrefing the type. So we need to call Py_XDECREF(self); instead and free ctx separately if self has not already been allocated. Note that the HMAC context is still cleared so we should not leak anything sensitive.
There is also a missing HMAC_CTX_free call in _hmac_digest, if the copy of the HMAC context fails. Again, there shouldn't be a security issue as the temporary context should still not be initialized on failure (and the secret key is not stored within, hopefully).
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Activity
[-]`_hashlib.hmac_new` is leaking if HMAC message object is of incorrect type[/-][+]`_hashlib.hmac_new` is missing a `Py_DECREF(type)` if HMAC message object is of incorrect type[/+][-]`_hashlib.hmac_new` is missing a `Py_DECREF(type)` if HMAC message object is of incorrect type[/-][+]Reference leaks in `_hashlib.hmac_new` and `_hashlib.hmac_digest`[/+]gh-130151: Fix reference leaks in `_hashlib.hmac_{new,digest}` (GH-13…
pythongh-130151: Fix reference leaks in `_hashlib.hmac_{new,digest}` (p…
[3.13] gh-130151: Fix reference leaks in `_hashlib.hmac_{new,digest}` (…
[3.12] gh-130151: Fix reference leaks in `_hashlib.hmac_{new,digest}` (…