Skip to content

Do not leave stale OpenSSL errors in _hashlib #159815

Open

Description

@picnixz

Bug report

raise_unsupported_algorithm_impl() peeks the OpenSSL error queue but does not clear it on the ERR_R_UNSUPPORTED and ERR_R_FETCH_FAILED branches. Only the default: branch clears it, via raise_ssl_error_f(). The leftover entry is then reported by the next unrelated failure in the same thread:

>>> import _hashlib
>>> _hashlib.scrypt(b"", salt=b"", n=1024, r=0, p=1)
ValueError: invalid parameter combination for n, r, p, and maxmem
>>> _hashlib.new("no_such_algorithm_xyz")
UnsupportedDigestmodError: [digital envelope routines] unsupported hash algorithm no_such_algorithm_xyz
>>> _hashlib.scrypt(b"", salt=b"", n=1024, r=0, p=1)
ValueError: [digital envelope routines] unsupported

get_asn1_utf8name_by_nid() has the same problem. It decides whether to fall back to the short name based on ERR_peek_last_error(), so a leftover error could make it raise instead of falling back.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.15bugs and security fixes3.16new features, bugs and security fixesextension-modulesC modules in the Modules dirtype-bugAn unexpected behavior, bug, or error

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions