Bad free in py_sha3_new_impl function

[alexhenrie]

BPO	43362
Nosy	@tiran, @alexhenrie
PRs	bpo-43362: Fix bad free in py_sha3_new_impl function #24702 bpo-43362: Fix invalid free and return check in _sha3 module (GH-25463) #25463

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2021-04-18.06:40:39.074>
created_at = <Date 2021-03-02.02:49:55.671>
labels = ['type-bug', 'library', '3.10']
title = 'Bad free in py_sha3_new_impl function'
updated_at = <Date 2021-04-18.06:40:39.073>
user = 'https://github.com/alexhenrie'

bugs.python.org fields:

activity = <Date 2021-04-18.06:40:39.073>
actor = 'christian.heimes'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2021-04-18.06:40:39.074>
closer = 'christian.heimes'
components = ['Library (Lib)']
creation = <Date 2021-03-02.02:49:55.671>
creator = 'alex.henrie'
dependencies = []
files = []
hgrepos = []
issue_num = 43362
keywords = ['patch']
message_count = 4.0
messages = ['387898', '391315', '391326', '391327']
nosy_count = 2.0
nosy_names = ['christian.heimes', 'alex.henrie']
pr_nums = ['24702', '25463']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue43362'
versions = ['Python 3.10']

[alexhenrie]

The py_sha3_new_impl function in sha3module.c has error handling code that looks like this:

    error:
      if (self) {
          Py_DECREF(self);
      }
      if (data && buf.obj) {
          PyBuffer_Release(&buf);
      }

However, there is a goto error before the variable buf is initialized. If that error path is triggered, the function will attempt to free an invalid object, possibly leading to a program crash.