[3.14] gh-155843: properly initialize HMAC objects to prevent crashes after allocation failures (GH-155845)

Misc/NEWS.d/next/Library/2026-08-15-13-54-22.gh-issue-155843.PD5Af3.rst

@@ -0,0 +1,2 @@
+:mod:`hmac`: ensure that HMAC objects are properly initialized to prevent
+rare crashes on allocation failures. Patch by Bénédikt Tran.

Modules/hmacmodule.c

@@ -370,14 +370,6 @@ get_hmacmodule_state(PyObject *module)
  return (hmacmodule_state *)state;
 }
 
-static inline hmacmodule_state *
-get_hmacmodule_state_by_cls(PyTypeObject *cls)
-{
- void *state = PyType_GetModuleState(cls);
- assert(state != NULL);
- return (hmacmodule_state *)state;
-}
-
 // --- HMAC Object ------------------------------------------------------------
 
 typedef Hacl_Streaming_HMAC_agile_state HACL_HMAC_state;
@@ -734,6 +726,30 @@ has_uint32_t_buffer_length(const Py_buffer *buffer)
 
 // --- HMAC object ------------------------------------------------------------
 
+/*
+ * Create a zero-initialized untracked HMAC object.
+ *
+ * Return NULL on failure with an exception set.
+ */
+static HMACObject *
+hmac_new_object(PyTypeObject *tp)
+{
+ // Using tp_alloc on GC objects automatically tracks them,
+ // but we need to first set the fields appropriately.
+ HMACObject *self = PyObject_GC_New(HMACObject, tp);
+ if (self == NULL) {
+ return NULL;
+ }
+ HASHLIB_INIT_MUTEX(self);
+ // PyObject_GC_New() does not zero-initialize
+ self->name = NULL;
+ self->kind = Py_hmac_kind_hash_unknown;
+ self->block_size = self->digest_size = 0;
+ self->api = (py_hmac_hacl_api){.compute = NULL, .compute_py = NULL};
+ self->state = NULL;
+ return self;
+}
+
 /*
  * Use the HMAC information 'info' to populate the corresponding fields.
  *
@@ -745,7 +761,7 @@ hmac_set_hinfo(hmacmodule_state *state,
  HMACObject *self, const py_hmac_hinfo *info)
 {
  assert(info->display_name != NULL);
- self->name = Py_NewRef(info->display_name);
+Py_XSETREF(self->name, Py_NewRef(info->display_name));
  assert_is_static_hmac_hash_kind(info->kind);
  self->kind = narrow_hmac_hash_kind(state, info->kind);
  assert(info->block_size <= Py_hmac_hash_max_block_size);
@@ -853,16 +869,15 @@ _hmac_new_impl(PyObject *module, PyObject *keyobj, PyObject *msgobj,
  return NULL;
  }
 
- HMACObject *self = PyObject_GC_New(HMACObject, state->hmac_type);
+ HMACObject *self = hmac_new_object(state->hmac_type);
  if (self == NULL) {
  return NULL;
  }
- HASHLIB_INIT_MUTEX(self);
  hmac_set_hinfo(state, self, info);
  int rc;
  // Create the HACL* internal state with the given key.
  Py_buffer key;
- GET_BUFFER_VIEW_OR_ERROR(keyobj, &key, goto error_on_key);
+ GET_BUFFER_VIEW_OR_ERROR(keyobj, &key, goto error);
  rc = hmac_new_initial_state(self, key.buf, key.len);
  PyBuffer_Release(&key);
  if (rc < 0) {
@@ -886,8 +901,6 @@ _hmac_new_impl(PyObject *module, PyObject *keyobj, PyObject *msgobj,
  PyObject_GC_Track(self);
  return (PyObject *)self;
 
-error_on_key:
- self->state = NULL;
 error:
  Py_DECREF(self);
  return NULL;
@@ -900,7 +913,7 @@ static void
 hmac_copy_hinfo(HMACObject *out, const HMACObject *src)
 {
  assert(src->name != NULL);
- out->name = Py_NewRef(src->name);
+Py_XSETREF(out->name, Py_NewRef(src->name));
  assert(src->kind != Py_hmac_kind_hash_unknown);
  out->kind = src->kind;
  assert(src->block_size <= Py_hmac_hash_max_block_size);
@@ -943,8 +956,7 @@ static PyObject *
 _hmac_HMAC_copy_impl(HMACObject *self, PyTypeObject *cls)
 /*[clinic end generated code: output=a955bfa55b65b215 input=17b2c0ad0b147e36]*/
 {
- hmacmodule_state *state = get_hmacmodule_state_by_cls(cls);
- HMACObject *copy = PyObject_GC_New(HMACObject, state->hmac_type);
+ HMACObject *copy = hmac_new_object(cls);
  if (copy == NULL) {
  return NULL;
  }
@@ -961,7 +973,6 @@ _hmac_HMAC_copy_impl(HMACObject *self, PyTypeObject *cls)
  return NULL;
  }
 
- HASHLIB_INIT_MUTEX(copy);
  PyObject_GC_Track(copy);
  return (PyObject *)copy;
 }