bpo-34922: Fix integer overflow in the digest() and hexdigest() methods (GH-9751)
for the SHAKE algorithm in the hashlib module.
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
index c8a873f..f83f73a 100644
--- a/Lib/test/test_hashlib.py
+++ b/Lib/test/test_hashlib.py
@@ -230,6 +230,19 @@
self.assertIsInstance(h.digest(), bytes)
self.assertEqual(hexstr(h.digest()), h.hexdigest())
+ def test_digest_length_overflow(self):
+ # See issue #34922
+ large_sizes = (2**29, 2**32-10, 2**32+10, 2**61, 2**64-10, 2**64+10)
+ for cons in self.hash_constructors:
+ h = cons()
+ if h.name not in self.shakes:
+ continue
+ for digest in h.digest, h.hexdigest:
+ self.assertRaises(ValueError, digest, -10)
+ for length in large_sizes:
+ with self.assertRaises((ValueError, OverflowError)):
+ digest(length)
+
def test_name_attribute(self):
for cons in self.hash_constructors:
h = cons()
diff --git a/Misc/NEWS.d/next/Library/2018-10-07-21-18-52.bpo-34922.37IdsA.rst b/Misc/NEWS.d/next/Library/2018-10-07-21-18-52.bpo-34922.37IdsA.rst
new file mode 100644
index 0000000..6463886
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2018-10-07-21-18-52.bpo-34922.37IdsA.rst
@@ -0,0 +1,3 @@
+Fixed integer overflow in the :meth:`~hashlib.shake.digest()` and
+:meth:`~hashlib.shake.hexdigest()` methods for the SHAKE algorithm
+in the :mod:`hashlib` module.
diff --git a/Modules/_sha3/sha3module.c b/Modules/_sha3/sha3module.c
index 46c1ff1..b737363 100644
--- a/Modules/_sha3/sha3module.c
+++ b/Modules/_sha3/sha3module.c
@@ -589,6 +589,10 @@
int res;
PyObject *result = NULL;
+ if (digestlen >= (1 << 29)) {
+ PyErr_SetString(PyExc_ValueError, "length is too large");
+ return NULL;
+ }
/* ExtractLane needs at least SHA3_MAX_DIGESTSIZE + SHA3_LANESIZE and
* SHA3_LANESIZE extra space.
*/