Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

bpo-43362: Fix invalid free and return check in _sha3 module (GH-25463) 

Commit 93d50a6a8d / GH-21855 changed the
order of variable definitions, which introduced a potential invalid free
bug. Py_buffer object is now initialized earlier and the result of
Keccak initialize is verified.

Co-authored-by: Alex Henrie <alexhenrie24@gmail.com>
Signed-off-by: Christian Heimes <christian@python.org>

Co-authored-by: Alex Henrie <alexhenrie24@gmail.com>
This commit is contained in:
Christian Heimes 2021-04-18 08:39:39 +02:00 committed by GitHub
parent f5c5c0c362
commit aa6da32edc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst Normal file
View File

@ -0,0 +1,2 @@
Fix invalid free in _sha3 module. The issue was introduced in 3.10.0a1.
Python 3.9 and earlier are not affected.

12
Modules/_sha3/sha3module.c
View File

@ -193,15 +193,16 @@ static PyObject *
py_sha3_new_impl(PyTypeObject *type, PyObject *data, int usedforsecurity)
/*[clinic end generated code: output=90409addc5d5e8b0 input=bcfcdf2e4368347a]*/
{
HashReturn res;
Py_buffer buf = {NULL, NULL};
SHA3State *state = PyType_GetModuleState(type);
SHA3object *self = newSHA3object(type);
if (self == NULL) {
goto error;
}
SHA3State *state = PyType_GetModuleState(type);
assert(state != NULL);
HashReturn res;
if (type == state->sha3_224_type) {
res = Keccak_HashInitialize_SHA3_224(&self->hash_state);
} else if (type == state->sha3_256_type) {
@ -229,7 +230,12 @@ py_sha3_new_impl(PyTypeObject *type, PyObject *data, int usedforsecurity)
goto error;
}
Py_buffer buf = {NULL, NULL};
if (res != SUCCESS) {
PyErr_SetString(PyExc_RuntimeError,
"internal error in SHA3 initialize()");
goto error;
}
if (data) {
GET_BUFFER_VIEW_OR_ERROR(data, &buf, goto error);
if (buf.len >= HASHLIB_GIL_MINSIZE) {