From: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Date: Thu, 19 Jun 2025 17:27:19 +0000 (+0200)
Subject: gh-135561: ensure that the GIL is held when handling an HACL* error in `_hmac` (... 
X-Git-Tag: v3.15.0a1~1242
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c76568339867422eca35876cabf82c06a55bbf56;p=thirdparty%2FPython%2Fcpython.git

gh-135561: ensure that the GIL is held when handling an HACL* error in `_hmac` (#135562)
---

diff --git a/Misc/NEWS.d/next/Library/2025-06-16-15-03-03.gh-issue-135561.mJCN8D.rst b/Misc/NEWS.d/next/Library/2025-06-16-15-03-03.gh-issue-135561.mJCN8D.rst
new file mode 100644
index 000000000000..ee743f161138
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-06-16-15-03-03.gh-issue-135561.mJCN8D.rst
@@ -0,0 +1,2 @@
+Fix a crash on DEBUG builds when an HACL* HMAC routine fails. Patch by
+Bénédikt Tran.
diff --git a/Modules/hmacmodule.c b/Modules/hmacmodule.c
index b404d5732ec8..9c92d9d145f5 100644
--- a/Modules/hmacmodule.c
+++ b/Modules/hmacmodule.c
@@ -493,36 +493,41 @@ narrow_hmac_hash_kind(hmacmodule_state *state, HMAC_Hash_Kind kind)
 static int
 _hacl_convert_errno(hacl_errno_t code, PyObject *algorithm)
 {
+    assert(PyGILState_GetThisThreadState() != NULL);
+    if (code == Hacl_Streaming_Types_Success) {
+        return 0;
+    }
+
+    PyGILState_STATE gstate = PyGILState_Ensure();
     switch (code) {
-        case Hacl_Streaming_Types_Success: {
-            return 0;
-        }
         case Hacl_Streaming_Types_InvalidAlgorithm: {
             // only makes sense if an algorithm is known at call time
             assert(algorithm != NULL);
             assert(PyUnicode_CheckExact(algorithm));
             PyErr_Format(PyExc_ValueError, "invalid algorithm: %U", algorithm);
-            return -1;
+            break;
         }
         case Hacl_Streaming_Types_InvalidLength: {
             PyErr_SetString(PyExc_ValueError, "invalid length");
-            return -1;
+            break;
         }
         case Hacl_Streaming_Types_MaximumLengthExceeded: {
             PyErr_SetString(PyExc_OverflowError, "maximum length exceeded");
-            return -1;
+            break;
         }
         case Hacl_Streaming_Types_OutOfMemory: {
             PyErr_NoMemory();
-            return -1;
+            break;
         }
         default: {
             PyErr_Format(PyExc_RuntimeError,
                          "HACL* internal routine failed with error code: %d",
                          code);
-            return -1;
+            break;
         }
     }
+    PyGILState_Release(gstate);
+    return -1;
 }
 
 /*