diff options
| -rw-r--r-- | Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst | 2 | ||||
| -rw-r--r-- | Modules/_sha3/sha3module.c | 12 |
2 files changed, 11 insertions, 3 deletions
diff --git a/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst b/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst new file mode 100644 index 0000000..713a683 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst @@ -0,0 +1,2 @@ +Fix invalid free in _sha3 module. The issue was introduced in 3.10.0a1. +Python 3.9 and earlier are not affected. diff --git a/Modules/_sha3/sha3module.c b/Modules/_sha3/sha3module.c index cae10f9..27f6938 100644 --- a/Modules/_sha3/sha3module.c +++ b/Modules/_sha3/sha3module.c @@ -193,15 +193,16 @@ static PyObject * py_sha3_new_impl(PyTypeObject *type, PyObject *data, int usedforsecurity) /*[clinic end generated code: output=90409addc5d5e8b0 input=bcfcdf2e4368347a]*/ { + HashReturn res; + Py_buffer buf = {NULL, NULL}; + SHA3State *state = PyType_GetModuleState(type); SHA3object *self = newSHA3object(type); if (self == NULL) { goto error; } - SHA3State *state = PyType_GetModuleState(type); assert(state != NULL); - HashReturn res; if (type == state->sha3_224_type) { res = Keccak_HashInitialize_SHA3_224(&self->hash_state); } else if (type == state->sha3_256_type) { @@ -229,7 +230,12 @@ py_sha3_new_impl(PyTypeObject *type, PyObject *data, int usedforsecurity) goto error; } - Py_buffer buf = {NULL, NULL}; + if (res != SUCCESS) { + PyErr_SetString(PyExc_RuntimeError, + "internal error in SHA3 initialize()"); + goto error; + } + if (data) { GET_BUFFER_VIEW_OR_ERROR(data, &buf, goto error); if (buf.len >= HASHLIB_GIL_MINSIZE) { |