]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-136912: fix handling of `OverflowError` in `hmac.digest` (#136917)
authorBénédikt Tran <10796600+picnixz@users.noreply.github.com>
Sat, 26 Jul 2025 08:22:06 +0000 (10:22 +0200)
committerGitHub <noreply@github.com>
Sat, 26 Jul 2025 08:22:06 +0000 (08:22 +0000)
commitd658b9053beaacaae80e318f59a5ddd672aa757a
treebb6f3466ae9bedbcd9d72b21f4fe40637e305a0f
parentf7c380ef67d1d729a4c9168660a8249cfd984482
gh-136912: fix handling of `OverflowError` in `hmac.digest` (#136917)

The OpenSSL and HACL* implementations of HMAC single-shot
digest computation reject keys whose length exceeds `INT_MAX`
and `UINT32_MAX` respectively. The OpenSSL implementation
also rejects messages whose length exceed `INT_MAX`.

Using such keys in `hmac.digest` previously raised an `OverflowError`
which was propagated to the caller. This commit mitigates this case by
making `hmac.digest` fall back to HMAC's pure Python implementation
which accepts arbitrary large keys or messages.

This change only affects the top-level entrypoint `hmac.digest`, leaving
`_hashopenssl.hmac_digest` and `_hmac.compute_digest` untouched.
Lib/hmac.py
Lib/test/test_hmac.py
Misc/NEWS.d/next/Library/2025-07-21-11-56-47.gh-issue-136912.zWosAL.rst [new file with mode: 0644]