Bug report

Bug description:

Bug report

Bug description:

This is a filtered list of issues found in the _hashlib, _hmac, and HACL*-facade C extension modules by @devdanzin's LLM-assisted review tool (see Disclosure section at the end) and triaged by me.

_hashopenssl.c

• 32: bug (GIL issue) [33,45]: _hashlib: GIL may be released while attempting to set an exception #159811
• 34: bug (OpenSSL misuse): Do not leave stale OpenSSL errors in _hashlib #159815
• 🔴 38: _hashlib_HASH_dealloc uses PyObject_Free instead of tp->tp_free but it's deliberate because we use PyObject_New. This would need to be changed if we ever make that class subclassable.
• 🔴 40: oversized MAC size from a provider, bounded only by assert: this is a non-issue because OpenSSL itself assumes EVP_MAX_MD_SIZE everywhere and malicious provides are not part of the threat model.
• 🔴 43: not an issue: HMACobject.evp_md_nid is assigned after self->ctx in both constructors (cosmetic as it doesn't impact the code for now).
• 47: need investigation (read out of lock) [35,36]
• 🔴 49: _hashlib_HASH_update_impl and _hmac_HMAC_update_impl return a bare Py_None without a Py_NewRef. None is immortal and there are other places that already have this issue. I may consider a large cosmetic refactoring in the future that could fix that but it's not worth for now.
• 🔴 52: invalid hash types previously raised SystemError, but not abort (this is deliberate, if we have invalid hash types somehow, it may be more than a reason to report the bug and get it fixed upstream rather than silently catching the exception)

_hmacmodule.c

• 31/42: Ensure that HMAC objects are properly initialized #155843
• 33/45: bug (GIL issue) [32]: HACL* update() errors are handled without a thread state #159786
• 🔴 37: SIMD accelerated HMAC-BLAKE2 does not work (and will not be supported, see https://discuss.python.org/t/reduce-api-surface-for-blake2-to-match-openssl-semantics/109603/6).
• 🔴 50: not an issue (py_hmac_hinfo was claimed to be lacking a visitor method but none of its members are containers)

MD5, SHA-*, BLAKE2-*

• 35/36: Ensure that HACL* states are not read concurrently #155835 [47]
• 🔴 39: shake_*.digest() and shake_*.hexdigest() discard the return value of Hacl_Hash_SHA3_squeeze() but it's not possible for that function to fail because the method table rules and the pre-checks we perform.
• 41: bug (init) but addressed in gh-155833: GC-untrack MD5/SHA* objects before freeing the HACL* state #155834 directly (SHA3 missing initialization)
• 44: Ensure that cryptographic objects are GC-untracked first #155833
• 🔴 46: not planned (same rationale as 52, but for BLAKE-2 update())
• 48: Ensure that BLAKE-2 objects are fully initialized before being GC-tracked #155830
• 🔴 51: Fallible PyType_GetModuleState usage. More generally, getting the state of a module is inconsistently achieved in extension modules and we should decide whether (1) to consistently abort on DEBUG builds (2) abort on non-DEBUG builds via a fatal error (to prevent possibly expensive checks). Currently, code works because we assume non-subclassability in general, but we may consider a more defensive approach.

Disclosure

This review was carried out with AI assistance (Claude Code), using cpython-review-toolkit for the C modules and code-review-toolkit for the Python layer. Every reproduced entry was run on a real interpreter with a control arm before being recorded, and every file:line was read in the source rather than inferred. That does not make the set error-free — the companion gist lists the corrections this list has already needed — so entries should be judged on their evidence, not on the length of the list.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response