bpo-43362: Fix invalid free and return check in _sha3 module (GH-25463)

tiran · alexhenrie · web-flow · commit aa6da32edc3c · 2021-04-18T08:39:39.000+02:00
Commit 93d50a6 / GH-21855 changed the order of variable definitions, which introduced a potential invalid free bug. Py_buffer object is now initialized earlier and the result of Keccak initialize is verified. Co-authored-by: Alex Henrie <alexhenrie24@gmail.com> Signed-off-by: Christian Heimes <christian@python.org> Co-authored-by: Alex Henrie <alexhenrie24@gmail.com>
diff --git a/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst b/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst
@@ -0,0 +1,2 @@
+Fix invalid free in _sha3 module. The issue was introduced in 3.10.0a1.
+Python 3.9 and earlier are not affected.
diff --git a/Modules/_sha3/sha3module.c b/Modules/_sha3/sha3module.c
@@ -193,15 +193,16 @@ static PyObject *
 py_sha3_new_impl(PyTypeObject *type, PyObject *data, int usedforsecurity)
 /*[clinic end generated code: output=90409addc5d5e8b0 input=bcfcdf2e4368347a]*/
 {
+    HashReturn res;
+    Py_buffer buf = {NULL, NULL};
+    SHA3State *state = PyType_GetModuleState(type);
     SHA3object *self = newSHA3object(type);
     if (self == NULL) {
         goto error;
     }
 
-    SHA3State *state = PyType_GetModuleState(type);
     assert(state != NULL);
 
-    HashReturn res;
     if (type == state->sha3_224_type) {
         res = Keccak_HashInitialize_SHA3_224(&self->hash_state);
     } else if (type == state->sha3_256_type) {
@@ -229,7 +230,12 @@ py_sha3_new_impl(PyTypeObject *type, PyObject *data, int usedforsecurity)
         goto error;
     }
 
-    Py_buffer buf = {NULL, NULL};
+    if (res != SUCCESS) {
+        PyErr_SetString(PyExc_RuntimeError,
+                        "internal error in SHA3 initialize()");
+        goto error;
+    }
+
     if (data) {
         GET_BUFFER_VIEW_OR_ERROR(data, &buf, goto error);
         if (buf.len >= HASHLIB_GIL_MINSIZE) {

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Fix invalid free in _sha3 module. The issue was introduced in 3.10.0a1.`
	`2`	`+Python 3.9 and earlier are not affected.`