Skip to content

Commit 261633b

Browse files
picnixzpicnixz
authored
pythongh-131316: handle NULL values returned by HACL* functions (python#131324)
- Handle NULL returned by allocation functions. - Handle NULL returned by copy functions. - Suppress unused impossible return codes.
1 parent de8890f commit 261633b

File tree

5 files changed

+309
-142
lines changed

5 files changed

+309
-142
lines changed

‎Modules/blake2module.c‎

Lines changed: 102 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -395,26 +395,33 @@ new_Blake2Object(PyTypeObject *type)
395395
* 64 bits so we loop in <4gig chunks when needed. */
396396

397397
#if PY_SSIZE_T_MAX > UINT32_MAX
398-
#define HACL_UPDATE_LOOP(update,state,buf,len) \
399-
while (len > UINT32_MAX) { \
400-
update(state, buf, UINT32_MAX); \
401-
len -= UINT32_MAX; \
402-
buf += UINT32_MAX; \
403-
}
398+
# define HACL_UPDATE_LOOP(UPDATE_FUNC, STATE, BUF, LEN) \
399+
do { \
400+
while (LEN > UINT32_MAX) { \
401+
(void)UPDATE_FUNC(STATE, BUF, UINT32_MAX); \
402+
LEN -= UINT32_MAX; \
403+
BUF += UINT32_MAX; \
404+
} \
405+
} while (0)
404406
#else
405-
#define HACL_UPDATE_LOOP(update,state,buf,len)
407+
# define HACL_UPDATE_LOOP(...)
406408
#endif
407409

408-
#define HACL_UPDATE(update,state,buf,len) do { \
409-
/* Note: we explicitly ignore the error code on the basis that it would take >
410-
* 1 billion years to overflow the maximum admissible length for SHA2-256
411-
* (namely, 2^61-1 bytes). */ \
412-
HACL_UPDATE_LOOP(update,state,buf,len) \
413-
/* Cast to uint32_t is safe: len <= UINT32_MAX at this point. */ \
414-
update(state, buf, (uint32_t) len); \
415-
} while (0)
410+
/*
411+
* Note: we explicitly ignore the error code on the basis that it would take
412+
* more than 1 billion years to overflow the maximum admissible length for
413+
* blake2b/2s (2^64 - 1).
414+
*/
415+
#define HACL_UPDATE(UPDATE_FUNC, STATE, BUF, LEN) \
416+
do { \
417+
HACL_UPDATE_LOOP(UPDATE_FUNC, STATE, BUF, LEN); \
418+
/* cast to uint32_t is now safe */ \
419+
(void)UPDATE_FUNC(STATE, BUF, (uint32_t)LEN); \
420+
} while (0)
416421

417-
static void update(Blake2Object *self, uint8_t *buf, Py_ssize_t len) {
422+
static void
423+
update(Blake2Object *self, uint8_t *buf, Py_ssize_t len)
424+
{
418425
switch (self->impl) {
419426
// These need to be ifdef'd out otherwise it's an unresolved symbol at
420427
// link-time.
@@ -583,21 +590,41 @@ py_blake2b_or_s_new(PyTypeObject *type, PyObject *data, int digest_size,
583590

584591
switch (self->impl) {
585592
#if HACL_CAN_COMPILE_SIMD256
586-
case Blake2b_256:
593+
case Blake2b_256: {
587594
self->blake2b_256_state = Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(&params, last_node, key->buf);
595+
if (self->blake2b_256_state == NULL) {
596+
(void)PyErr_NoMemory();
597+
goto error;
598+
}
588599
break;
600+
}
589601
#endif
590602
#if HACL_CAN_COMPILE_SIMD128
591-
case Blake2s_128:
603+
case Blake2s_128: {
592604
self->blake2s_128_state = Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(&params, last_node, key->buf);
605+
if (self->blake2s_128_state == NULL) {
606+
(void)PyErr_NoMemory();
607+
goto error;
608+
}
593609
break;
610+
}
594611
#endif
595-
case Blake2b:
612+
case Blake2b: {
596613
self->blake2b_state = Hacl_Hash_Blake2b_malloc_with_params_and_key(&params, last_node, key->buf);
614+
if (self->blake2b_state == NULL) {
615+
(void)PyErr_NoMemory();
616+
goto error;
617+
}
597618
break;
598-
case Blake2s:
619+
}
620+
case Blake2s: {
599621
self->blake2s_state = Hacl_Hash_Blake2s_malloc_with_params_and_key(&params, last_node, key->buf);
622+
if (self->blake2s_state == NULL) {
623+
(void)PyErr_NoMemory();
624+
goto error;
625+
}
600626
break;
627+
}
601628
default:
602629
Py_UNREACHABLE();
603630
}
@@ -610,7 +637,8 @@ py_blake2b_or_s_new(PyTypeObject *type, PyObject *data, int digest_size,
610637
Py_BEGIN_ALLOW_THREADS
611638
update(self, buf.buf, buf.len);
612639
Py_END_ALLOW_THREADS
613-
} else {
640+
}
641+
else {
614642
update(self, buf.buf, buf.len);
615643
}
616644
PyBuffer_Release(&buf);
@@ -688,44 +716,78 @@ py_blake2s_new_impl(PyTypeObject *type, PyObject *data, int digest_size,
688716
return py_blake2b_or_s_new(type, data, digest_size, key, salt, person, fanout, depth, leaf_size, node_offset, node_depth, inner_size, last_node, usedforsecurity);
689717
}
690718

691-
/*[clinic input]
692-
_blake2.blake2b.copy
693-
694-
Return a copy of the hash object.
695-
[clinic start generated code]*/
696-
697-
static PyObject *
698-
_blake2_blake2b_copy_impl(Blake2Object *self)
699-
/*[clinic end generated code: output=622d1c56b91c50d8 input=e383c2d199fd8a2e]*/
719+
static int
720+
blake2_blake2b_copy_locked(Blake2Object *self, Blake2Object *cpy)
700721
{
701-
Blake2Object *cpy;
702-
703-
if ((cpy = new_Blake2Object(Py_TYPE(self))) == NULL)
704-
return NULL;
705-
706-
ENTER_HASHLIB(self);
722+
assert(cpy != NULL);
707723
switch (self->impl) {
708724
#if HACL_CAN_COMPILE_SIMD256
709-
case Blake2b_256:
725+
case Blake2b_256: {
710726
cpy->blake2b_256_state = Hacl_Hash_Blake2b_Simd256_copy(self->blake2b_256_state);
727+
if (cpy->blake2b_256_state == NULL) {
728+
goto error;
729+
}
711730
break;
731+
}
712732
#endif
713733
#if HACL_CAN_COMPILE_SIMD128
714-
case Blake2s_128:
734+
case Blake2s_128: {
715735
cpy->blake2s_128_state = Hacl_Hash_Blake2s_Simd128_copy(self->blake2s_128_state);
736+
if (cpy->blake2s_128_state == NULL) {
737+
goto error;
738+
}
716739
break;
740+
}
717741
#endif
718-
case Blake2b:
742+
case Blake2b: {
719743
cpy->blake2b_state = Hacl_Hash_Blake2b_copy(self->blake2b_state);
744+
if (cpy->blake2b_state == NULL) {
745+
goto error;
746+
}
720747
break;
721-
case Blake2s:
748+
}
749+
case Blake2s: {
722750
cpy->blake2s_state = Hacl_Hash_Blake2s_copy(self->blake2s_state);
751+
if (cpy->blake2s_state == NULL) {
752+
goto error;
753+
}
723754
break;
755+
}
724756
default:
725757
Py_UNREACHABLE();
726758
}
727759
cpy->impl = self->impl;
760+
return 0;
761+
762+
error:
763+
(void)PyErr_NoMemory();
764+
return -1;
765+
}
766+
767+
/*[clinic input]
768+
_blake2.blake2b.copy
769+
770+
Return a copy of the hash object.
771+
[clinic start generated code]*/
772+
773+
static PyObject *
774+
_blake2_blake2b_copy_impl(Blake2Object *self)
775+
/*[clinic end generated code: output=622d1c56b91c50d8 input=e383c2d199fd8a2e]*/
776+
{
777+
int rc;
778+
Blake2Object *cpy;
779+
780+
if ((cpy = new_Blake2Object(Py_TYPE(self))) == NULL) {
781+
return NULL;
782+
}
783+
784+
ENTER_HASHLIB(self);
785+
rc = blake2_blake2b_copy_locked(self, cpy);
728786
LEAVE_HASHLIB(self);
787+
if (rc < 0) {
788+
Py_DECREF(cpy);
789+
return NULL;
790+
}
729791
return (PyObject *)cpy;
730792
}
731793

‎Modules/md5module.c‎

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -121,12 +121,17 @@ MD5Type_copy_impl(MD5object *self, PyTypeObject *cls)
121121
MD5State *st = PyType_GetModuleState(cls);
122122

123123
MD5object *newobj;
124-
if ((newobj = newMD5object(st))==NULL)
124+
if ((newobj = newMD5object(st)) == NULL) {
125125
return NULL;
126+
}
126127

127128
ENTER_HASHLIB(self);
128129
newobj->hash_state = Hacl_Hash_MD5_copy(self->hash_state);
129130
LEAVE_HASHLIB(self);
131+
if (newobj->hash_state == NULL) {
132+
Py_DECREF(self);
133+
return PyErr_NoMemory();
134+
}
130135
return (PyObject *)newobj;
131136
}
132137

@@ -173,15 +178,23 @@ MD5Type_hexdigest_impl(MD5object *self)
173178
return PyUnicode_FromStringAndSize(digest_hex, sizeof(digest_hex));
174179
}
175180

176-
static void update(Hacl_Hash_MD5_state_t *state, uint8_t *buf, Py_ssize_t len) {
181+
static void
182+
update(Hacl_Hash_MD5_state_t *state, uint8_t *buf, Py_ssize_t len)
183+
{
184+
/*
185+
* Note: we explicitly ignore the error code on the basis that it would
186+
* take more than 1 billion years to overflow the maximum admissible length
187+
* for MD5 (2^61 - 1).
188+
*/
177189
#if PY_SSIZE_T_MAX > UINT32_MAX
178-
while (len > UINT32_MAX) {
179-
Hacl_Hash_MD5_update(state, buf, UINT32_MAX);
180-
len -= UINT32_MAX;
181-
buf += UINT32_MAX;
182-
}
190+
while (len > UINT32_MAX) {
191+
(void)Hacl_Hash_MD5_update(state, buf, UINT32_MAX);
192+
len -= UINT32_MAX;
193+
buf += UINT32_MAX;
194+
}
183195
#endif
184-
Hacl_Hash_MD5_update(state, buf, (uint32_t) len);
196+
/* cast to uint32_t is now safe */
197+
(void)Hacl_Hash_MD5_update(state, buf, (uint32_t)len);
185198
}
186199

187200
/*[clinic input]
@@ -286,32 +299,36 @@ _md5_md5_impl(PyObject *module, PyObject *string, int usedforsecurity)
286299
MD5object *new;
287300
Py_buffer buf;
288301

289-
if (string)
302+
if (string) {
290303
GET_BUFFER_VIEW_OR_ERROUT(string, &buf);
304+
}
291305

292306
MD5State *st = md5_get_state(module);
293307
if ((new = newMD5object(st)) == NULL) {
294-
if (string)
308+
if (string) {
295309
PyBuffer_Release(&buf);
310+
}
296311
return NULL;
297312
}
298313

299314
new->hash_state = Hacl_Hash_MD5_malloc();
300-
301-
if (PyErr_Occurred()) {
315+
if (new->hash_state == NULL) {
302316
Py_DECREF(new);
303-
if (string)
317+
if (string) {
304318
PyBuffer_Release(&buf);
305-
return NULL;
319+
}
320+
return PyErr_NoMemory();
306321
}
322+
307323
if (string) {
308324
if (buf.len >= HASHLIB_GIL_MINSIZE) {
309325
/* We do not initialize self->lock here as this is the constructor
310326
* where it is not yet possible to have concurrent access. */
311327
Py_BEGIN_ALLOW_THREADS
312328
update(new->hash_state, buf.buf, buf.len);
313329
Py_END_ALLOW_THREADS
314-
} else {
330+
}
331+
else {
315332
update(new->hash_state, buf.buf, buf.len);
316333
}
317334
PyBuffer_Release(&buf);

0 commit comments

Comments
 (0)