-
-
Notifications
You must be signed in to change notification settings - Fork 32.4k
Closed
Labels
3.12only security fixesonly security fixes3.13bugs and security fixesbugs and security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
Description
Bug report
Bug description:
While reading the hashlib code, I found some issues in the error branches where the EVP_MD_ctx
is not freed upon failure or when we call py_digest_name
with a NULL EVP_MD *
.
@gpshead Should I consider this as a security issue? (some places might be a security issue since we are leaking some EVP_MD context objects but others are just leaking un-initialized contexts).
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
- gh-127667: fix more reference leaks in
hashlib
#127668 - [3.12] gh-127667: fix memory leaks in
hashlib
(GH-127668) #130783 - [3.13] gh-127667: fix memory leaks in
hashlib
(GH-127668) #130784 - gh-127667: refactor and improve
_hashopenssl.c
error branches #131145 - [3.13] gh-127667: refactor and improve
_hashopenssl.c
error branches (#131145) #131347 - [3.12] gh-127667: refactor and improve
_hashopenssl.c
error branches (#131145) #131348
Metadata
Metadata
Assignees
Labels
3.12only security fixesonly security fixes3.13bugs and security fixesbugs and security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error