gh-155833: GC-untrack MD5/SHA* objects before freeing the HACL*state

Author: picnixz

Misc/NEWS.d/next/Library/2026-08-15-12-08-33.gh-issue-155833.Pi2Yjp.rst

@@ -0,0 +1,2 @@
+Ensure that MD5 and SHA* objects are properly GC-untracked before freeing
+their internal HACL* state. Patch by Bénédikt Tran.

Modules/md5module.c

@@ -86,13 +86,13 @@ newMD5object(MD5State * st)
 static void
 MD5_dealloc(PyObject *op)
 {
+    PyTypeObject *tp = Py_TYPE(op);
+    PyObject_GC_UnTrack(op);
     MD5object *ptr = _MD5object_CAST(op);
     if (ptr->hash_state != NULL) {
         Hacl_Hash_MD5_free(ptr->hash_state);
         ptr->hash_state = NULL;
     }
-    PyTypeObject *tp = Py_TYPE(op);
-    PyObject_GC_UnTrack(ptr);
     PyObject_GC_Del(ptr);
     Py_DECREF(tp);
 }

Modules/sha1module.c

@@ -75,6 +75,7 @@ newSHA1object(SHA1State *st)
         return NULL;
     }
     HASHLIB_INIT_MUTEX(sha);
+    sha->hash_state = NULL; // PyObject_GC_New() does not zero memory
 
     PyObject_GC_Track(sha);
     return sha;
@@ -85,13 +86,13 @@ newSHA1object(SHA1State *st)
 static void
 SHA1_dealloc(PyObject *op)
 {
+    PyTypeObject *tp = Py_TYPE(op);
+    PyObject_GC_UnTrack(op);
     SHA1object *ptr = _SHA1object_CAST(op);
     if (ptr->hash_state != NULL) {
         Hacl_Hash_SHA1_free(ptr->hash_state);
         ptr->hash_state = NULL;
     }
-    PyTypeObject *tp = Py_TYPE(ptr);
-    PyObject_GC_UnTrack(ptr);
     PyObject_GC_Del(ptr);
     Py_DECREF(tp);
 }

Modules/sha2module.c

@@ -146,6 +146,7 @@ newSHA384object(sha2_state *state)
         return NULL;
     }
     HASHLIB_INIT_MUTEX(sha);
+    sha->state = NULL; // PyObject_GC_New() does not zero memory
 
     PyObject_GC_Track(sha);
     return sha;
@@ -159,6 +160,7 @@ newSHA512object(sha2_state *state)
         return NULL;
     }
     HASHLIB_INIT_MUTEX(sha);
+    sha->state = NULL; // PyObject_GC_New() does not zero memory
 
     PyObject_GC_Track(sha);
     return sha;
@@ -168,27 +170,27 @@ newSHA512object(sha2_state *state)
 static void
 SHA256_dealloc(PyObject *op)
 {
+    PyTypeObject *tp = Py_TYPE(op);
+    PyObject_GC_UnTrack(op);
     SHA256object *ptr = _SHA256object_CAST(op);
     if (ptr->state != NULL) {
         Hacl_Hash_SHA2_free_256(ptr->state);
         ptr->state = NULL;
     }
-    PyTypeObject *tp = Py_TYPE(ptr);
-    PyObject_GC_UnTrack(ptr);
     PyObject_GC_Del(ptr);
     Py_DECREF(tp);
 }
 
 static void
 SHA512_dealloc(PyObject *op)
 {
+    PyTypeObject *tp = Py_TYPE(op);
+    PyObject_GC_UnTrack(op);
     SHA512object *ptr = _SHA512object_CAST(op);
     if (ptr->state != NULL) {
         Hacl_Hash_SHA2_free_512(ptr->state);
         ptr->state = NULL;
     }
-    PyTypeObject *tp = Py_TYPE(ptr);
-    PyObject_GC_UnTrack(ptr);
     PyObject_GC_Del(ptr);
     Py_DECREF(tp);
 }

Modules/sha3module.c

@@ -96,6 +96,7 @@ newSHA3object(PyTypeObject *type)
         return NULL;
     }
     HASHLIB_INIT_MUTEX(newobj);
+    newobj->hash_state = NULL; // PyObject_GC_New() does not zero memory
 
     PyObject_GC_Track(newobj);
     return newobj;
@@ -223,7 +224,7 @@ SHA3_dealloc(PyObject *self)
     PyTypeObject *tp = Py_TYPE(self);
     PyObject_GC_UnTrack(self);
     (void)SHA3_clear(self);
-    tp->tp_free(self);
+    PyObject_GC_Del(self);
     Py_DECREF(tp);
 }