Description

picnixz

opened on Jun 20, 2025

Issue body actions

Bug report

Bug description:

import _hashlib

_hashlib.openssl_shake_128(b'').digest(-1)     # SystemError
_hashlib.openssl_shake_128(b'').hexdigest(-1)  # MemoryError

import _sha3
_sha3.shake_128(b'').digest(-1)                # ValueError
_sha3.shake_128(b'').hexdigest(-1)             # ValueError

The reason is that OpenSSL implementation accepts a ssize_t but HACL* accepts a uint32_t. I suggest raising a ValueError in OpenSSL's implementation as well. I'll rewrite #135744 for this issue at the same time.

Now, to prevent users passing incorrect data length, I also suggest to restrict has lengths to 2 ** 29 as it was done in HACL* and in #79103 but I'll do it in a follow-up. In the first time, let's only focus on raising a ValueError for all implementations on negative inputs.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• gh-135759: consistently reject negative sizes in SHAKE digests #135767

Note

See #135759 (comment) for the rationale of a non-backport.

Activity

1. picnixz

   self-assigned this

   on Jun 20, 2025
2. picnixz

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   on Jun 20, 2025
3. picnixz commented on Jun 20, 2025

   

   picnixz

   on Jun 20, 2025

   MemberAuthor

   More actions

   I'm not going to backport this as this changes error messages and exception types. AFAIK, there is no crash, just weird exception types.
4. picnixz

   added a commit that references this issue on Jun 21, 2025

   gh-135759: consistently reject negative sizes in SHAKE digests (#135767)

   7c43615
5. picnixz

   closed this as completedon Jun 21, 2025
6. Pranjal095

   added a commit that references this issue on Jul 12, 2025

   pythongh-135759: consistently reject negative sizes in SHAKE digests (p…

   25e8eb1
7. taegyunkim

   added a commit that references this issue on Aug 4, 2025

   pythongh-135759: consistently reject negative sizes in SHAKE digests (p…

   86df870
8. Agent-Hellboy

   added a commit that references this issue on Aug 19, 2025

   pythongh-135759: consistently reject negative sizes in SHAKE digests (p…

   fd613a7

Issue actions