From aa6da32edc3c6ddfda5e849561e20273b8d82771 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Sun, 18 Apr 2021 08:39:39 +0200 Subject: bpo-43362: Fix invalid free and return check in _sha3 module (GH-25463) Commit 93d50a6a8d0c5d332c11aef267e66573a09765ac / GH-21855 changed the order of variable definitions, which introduced a potential invalid free bug. Py_buffer object is now initialized earlier and the result of Keccak initialize is verified. Co-authored-by: Alex Henrie Signed-off-by: Christian Heimes Co-authored-by: Alex Henrie --- .../next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst | 2 ++ Modules/_sha3/sha3module.c | 12 +++++++++--- 2 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst diff --git a/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst b/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst new file mode 100644 index 0000000..713a683 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst @@ -0,0 +1,2 @@ +Fix invalid free in _sha3 module. The issue was introduced in 3.10.0a1. +Python 3.9 and earlier are not affected. diff --git a/Modules/_sha3/sha3module.c b/Modules/_sha3/sha3module.c index cae10f9..27f6938 100644 --- a/Modules/_sha3/sha3module.c +++ b/Modules/_sha3/sha3module.c @@ -193,15 +193,16 @@ static PyObject * py_sha3_new_impl(PyTypeObject *type, PyObject *data, int usedforsecurity) /*[clinic end generated code: output=90409addc5d5e8b0 input=bcfcdf2e4368347a]*/ { + HashReturn res; + Py_buffer buf = {NULL, NULL}; + SHA3State *state = PyType_GetModuleState(type); SHA3object *self = newSHA3object(type); if (self == NULL) { goto error; } - SHA3State *state = PyType_GetModuleState(type); assert(state != NULL); - HashReturn res; if (type == state->sha3_224_type) { res = Keccak_HashInitialize_SHA3_224(&self->hash_state); } else if (type == state->sha3_256_type) { @@ -229,7 +230,12 @@ py_sha3_new_impl(PyTypeObject *type, PyObject *data, int usedforsecurity) goto error; } - Py_buffer buf = {NULL, NULL}; + if (res != SUCCESS) { + PyErr_SetString(PyExc_RuntimeError, + "internal error in SHA3 initialize()"); + goto error; + } + if (data) { GET_BUFFER_VIEW_OR_ERROR(data, &buf, goto error); if (buf.len >= HASHLIB_GIL_MINSIZE) { -- cgit v0.12