[3.14] gh-145376: Fix crashes in `md5module.c` and `hmacmodule.c` (GH-145422) (#145610)

gh-145376: Fix crashes in `md5module.c` and `hmacmodule.c` (GH-145422)

Fix a possible NULL pointer dereference in `md5module.c` and a double-free in `hmacmodule.c`.
Those crashes only occur in error paths taken when the interpreter fails to allocate memory.
(cherry picked from commit c1d77683213c400fca144692654845e6f5418981)

Co-authored-by: Pieter Eendebak <pieter.eendebak@gmail.com>

diff --git a/Misc/NEWS.d/next/Library/2026-03-02-19-41-39.gh-issue-145376.OOzSOh.rst b/Misc/NEWS.d/next/Library/2026-03-02-19-41-39.gh-issue-145376.OOzSOh.rst
new file mode 100644 (file)
index 0000000..b6dbda0
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-03-02-19-41-39.gh-issue-145376.OOzSOh.rst
@@ -0,0 +1,2 @@
+Fix double free and null pointer dereference in unusual error scenarios
+in :mod:`hashlib` and :mod:`hmac` modules.

diff --git a/Modules/hmacmodule.c b/Modules/hmacmodule.c
index bc711b51accd8761b80fe6be70d11a7510fe32cb..8a0b3496b1afa132ec36ecf7d28665d4d6ee255c 100644 (file)
--- a/Modules/hmacmodule.c
+++ b/Modules/hmacmodule.c
@@ -1529,7 +1529,6 @@ static void
 py_hmac_hinfo_ht_free(void *hinfo)
 {
     py_hmac_hinfo *entry = (py_hmac_hinfo *)hinfo;
-    assert(entry->display_name != NULL);
     if (--(entry->refcnt) == 0) {
         Py_CLEAR(entry->display_name);
         PyMem_Free(hinfo);
@@ -1628,7 +1627,8 @@ py_hmac_hinfo_ht_new(void)
             e->hashlib_name == NULL ? e->name : e->hashlib_name
         );
         if (value->display_name == NULL) {
-            PyMem_Free(value);
+            /* 'value' is owned by the table (refcnt > 0),
+               so _Py_hashtable_destroy() will free it. */
             goto error;
         }
     }

diff --git a/Modules/md5module.c b/Modules/md5module.c
index 9b5ea2d6e02605a74c0d332988ede5d2b7c1c30e..f3855ec3f37faa1bc09b44a306d75e918757c8d2 100644 (file)
--- a/Modules/md5module.c
+++ b/Modules/md5module.c
@@ -87,7 +87,10 @@ static void
 MD5_dealloc(PyObject *op)
 {
     MD5object *ptr = _MD5object_CAST(op);
-    Hacl_Hash_MD5_free(ptr->hash_state);
+    if (ptr->hash_state != NULL) {
+        Hacl_Hash_MD5_free(ptr->hash_state);
+        ptr->hash_state = NULL;
+    }
     PyTypeObject *tp = Py_TYPE(op);
     PyObject_GC_UnTrack(ptr);
     PyObject_GC_Del(ptr);