From 6ed37430d31e915103ab5decd14d757eb2d159d5 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Tue, 19 May 2020 15:52:54 -0700 Subject: [PATCH] bpo-40645: restrict HMAC key len to INT_MAX (GH-20238) Signed-off-by: Christian Heimes Automerge-Triggered-By: @tiran (cherry picked from commit aca4670ad695d4b01c7880fe3d0af817421945bd) Co-authored-by: Christian Heimes --- Modules/_hashopenssl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c index 36ad6a65d72..674bddc090a 100644 --- a/Modules/_hashopenssl.c +++ b/Modules/_hashopenssl.c @@ -1403,6 +1403,12 @@ _hashlib_hmac_new_impl(PyObject *module, Py_buffer *key, PyObject *msg_obj, HMACobject *self = NULL; int r; + if (key->len > INT_MAX) { + PyErr_SetString(PyExc_OverflowError, + "key is too long."); + return NULL; + } + if ((digestmod == NULL) || !strlen(digestmod)) { PyErr_SetString( PyExc_TypeError, "Missing required parameter 'digestmod'."); @@ -1424,7 +1430,7 @@ _hashlib_hmac_new_impl(PyObject *module, Py_buffer *key, PyObject *msg_obj, r = HMAC_Init_ex( ctx, (const char*)key->buf, - key->len, + (int)key->len, digest, NULL /*impl*/); if (r == 0) {