NotificationsYou must be signed in to change notification settings
Fork33.3k
Star69.7k

[3.14] gh-136912: fix handling of`OverflowError` in`hmac.digest` (GH-136917)#137116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

picnixz merged 2 commits intopython:3.14frompicnixz:backport-d658b90-3.14

Oct 8, 2025

Merged

[3.14] gh-136912: fix handling of`OverflowError` in`hmac.digest` (GH-136917)#137116

picnixz merged 2 commits intopython:3.14frompicnixz:backport-d658b90-3.14

Oct 8, 2025

Conversation

Copy link

Member

picnixz commentedJul 26, 2025•
edited by bedevere-appbot
Loading

The OpenSSL and HACL* implementations of HMAC single-shot digest computation reject keys whose length exceedsINT_MAX andUINT32_MAX respectively. The OpenSSL implementation also rejects messages whose length exceedINT_MAX.

Using such keys inhmac.digest previously raised anOverflowError which was propagated to the caller. This commit mitigates this case by makinghmac.digest fall back to HMAC's pure Python implementation which accepts arbitrary large keys or messages.

This change only affects the top-level entrypointhmac.digest, leaving_hashopenssl.hmac_digest and_hmac.compute_digest untouched.

(cherry picked from commitd658b90)

Issue:Solve HMAC one-shot digest limitations #136912

[3.14]pythongh-136912: fix handling ofOverflowErrorin `hmac.dige…

ab852a2

…st` (pythonGH-136917)The OpenSSL and HACL* implementations of HMAC single-shotdigest computation reject keys whose length exceeds `INT_MAX`and `UINT32_MAX` respectively. The OpenSSL implementationalso rejects messages whose length exceed `INT_MAX`.Using such keys in `hmac.digest` previously raised an `OverflowError`which was propagated to the caller. This commit mitigates this case bymaking `hmac.digest` fall back to HMAC's pure Python implementationwhich accepts arbitrary large keys or messages.This change only affects the top-level entrypoint `hmac.digest`, leaving`_hashopenssl.hmac_digest` and `_hmac.compute_digest` untouched.(cherry picked from commitd658b90)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

This was referencedJul 26, 2025

Solve HMAC one-shot digest limitations#136912

Closed

gh-136912: fix handling ofOverflowError inhmac.digest#136917

Merged