simplify ifdefs: always check for the hacl error

Author: gpshead

Misc/NEWS.d/next/Library/2026-10-19-21-20-28.gh-issue-159786.fThehQ.rst

@@ -1,4 +1,6 @@
-Fix a crash on DEBUG builds when the HACL* routine used by
-:meth:`hmac.HMAC.update` fails. This only happens for messages larger
-than 4 GiB once the maximum input length of the underlying hash function
-is exceeded. Patch by Bénédikt Tran.
+Fix the error handling of the HACL* routine used by :func:`hmac.new` and
+:meth:`hmac.HMAC.update`. If the maximum input length of the underlying hash
+function is exceeded, an :exc:`OverflowError` is now raised on all builds,
+instead of crashing on DEBUG builds and being silently ignored otherwise.
+Code correctness. Realistically this can only happen at implausible sizes.
+Patch by Bénédikt Tran.

Modules/hmacmodule.c

@@ -449,28 +449,19 @@ _hacl_hmac_state_free(HACL_HMAC_state *state)
 /*
  * Call the HACL* HMAC-HASH update function on the given data.
  *
- * On DEBUG builds, the update() call is verified.
- *
  * Return the HACL* exit code. No exception is set, so that this
  * can be called without an attached thread state or with a lock held.
 */
 static hacl_errno_t
 _hacl_hmac_state_update_once(HACL_HMAC_state *state,
                              uint8_t *buf, uint32_t len)
 {
-#ifndef NDEBUG
     return Hacl_Streaming_HMAC_update(state, buf, len);
-#else
-    (void)Hacl_Streaming_HMAC_update(state, buf, len);
-    return Hacl_Streaming_Types_Success;
-#endif
 }
 
 /*
  * Perform the HMAC-HASH update() operation in a streaming fashion.
  *
- * On DEBUG builds, each update() call is verified.
- *
  * Return the HACL* exit code. No exception is set, so that this
  * can be called without an attached thread state or with a lock held.
  * Use _hacl_convert_errno() afterwards to set an appropriate exception.
@@ -795,14 +786,10 @@ _hmac_new_impl(PyObject *module, PyObject *keyobj, PyObject *msgobj,
             code = _hacl_hmac_state_update(self->state, msg.buf, msg.len)
         );
         PyBuffer_Release(&msg);
-#ifndef NDEBUG
         rc = _hacl_convert_errno(code);
         if (rc < 0) {
             goto error;
         }
-#else
-        (void)code;
-#endif
     }
     assert(rc == 0);
     return (PyObject *)self;