Skip to content

Commit a7e690b

Browse files
krylosov-aamiss-islington
authored andcommitted
gh-145301: Fix double-free in hashlib and hmac module initialization (GH-145321)
(cherry picked from commit 6acaf65) Co-authored-by: krylosov-aa <krylosov.andrew@gmail.com> gh-145301: Fix double-free in hashlib and hmac initialization
1 parent e58e980 commit a7e690b

File tree

4 files changed

+18
-11
lines changed

4 files changed

+18
-11
lines changed
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
:mod:`hashlib`: fix a crash when the initialization of the underlying C
2+
extension module fails.
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
:mod:`hmac`: fix a crash when the initialization of the underlying C
2+
extension module fails.

Modules/_hashopenssl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,7 @@ py_hashentry_table_new(void) {
238238

239239
if (h->py_alias != NULL) {
240240
if (_Py_hashtable_set(ht, (const void*)entry->py_alias, (void*)entry) < 0) {
241-
PyMem_Free(entry);
241+
/* entry is already in ht, will be freed by _Py_hashtable_destroy() */
242242
goto error;
243243
}
244244
entry->refcnt++;

Modules/hmacmodule.c

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1604,16 +1604,19 @@ py_hmac_hinfo_ht_new(void)
16041604
assert(value->display_name == NULL);
16051605
value->refcnt = 0;
16061606

1607-
#define Py_HMAC_HINFO_LINK(KEY) \
1608-
do { \
1609-
int rc = py_hmac_hinfo_ht_add(table, KEY, value); \
1610-
if (rc < 0) { \
1611-
PyMem_Free(value); \
1612-
goto error; \
1613-
} \
1614-
else if (rc == 1) { \
1615-
value->refcnt++; \
1616-
} \
1607+
#define Py_HMAC_HINFO_LINK(KEY) \
1608+
do { \
1609+
int rc = py_hmac_hinfo_ht_add(table, (KEY), value); \
1610+
if (rc < 0) { \
1611+
/* entry may already be in ht, freed upon exit */ \
1612+
if (value->refcnt == 0) { \
1613+
PyMem_Free(value); \
1614+
} \
1615+
goto error; \
1616+
} \
1617+
else if (rc == 1) { \
1618+
value->refcnt++; \
1619+
} \
16171620
} while (0)
16181621
Py_HMAC_HINFO_LINK(e->name);
16191622
Py_HMAC_HINFO_LINK(e->hashlib_name);

0 commit comments

Comments
 (0)