gh-145301: Fix double-free in hmac module initialization

Author: krylosov-aa

Lib/test/test_hashlib.py

@@ -18,6 +18,8 @@
 import tempfile
 import threading
 import unittest
+import subprocess
+import textwrap
 from test import support
 from test.support import _4G, bigmemtest
 from test.support import hashlib_helper
@@ -1201,6 +1203,43 @@ def test_readonly_types(self):
                     with self.assertRaisesRegex(TypeError, "immutable type"):
                         hash_type.value = False
 
+    @unittest.skipUnless(HASH is not None, 'need _hashlib')
+    def test_hashlib_init_memory_error_no_df(self):
+        """gh-145301 regression test."""
+
+        try:
+            import _testcapi
+            if not hasattr(_testcapi, 'set_nomemory'):
+                self.skipTest('requires _testcapi.set_nomemory')
+        except ImportError:
+            self.skipTest('requires _testcapi')
+
+        code = textwrap.dedent("""
+            import sys
+            import _testcapi
+
+            if '_hashlib' in sys.modules:
+                del sys.modules['_hashlib']
+
+            _testcapi.set_nomemory(40, 41)
+            try:
+                import _hashlib
+            except (MemoryError, ImportError):
+                pass
+            finally:
+                _testcapi.remove_mem_hooks()
+        """)
+
+        rc = subprocess.call(
+            [sys.executable, '-c', code],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        # rc < 0 means crash (signal on Unix), which indicates double-free
+        # rc >= 0 means normal exit (even with MemoryError), which is expected
+        self.assertGreaterEqual(rc, 0,
+                                "Process crashed - Loss double-free in _hashlib")
+
 
 class KDFTests(unittest.TestCase):
 

Modules/hmacmodule.c

@@ -1457,7 +1457,8 @@ py_hmac_hinfo_ht_new(void)
         do {                                                    \
             int rc = py_hmac_hinfo_ht_add(table, KEY, value);   \
             if (rc < 0) {                                       \
-                /* entry may already be in ht, will be freed by _Py_hashtable_destroy() */ \
+                /* entry may already be in ht, will be freed by \
+                _Py_hashtable_destroy() */                      \
                 if (value->refcnt == 0) {                       \
                     PyMem_Free(value);                          \
                 }                                               \