You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is a filtered list of issues found in the _hashlib, _hmac, and HACL*-facade C extension modules by @devdanzin's LLM-assisted review tool (see Disclosure section at the end) and triaged by me.
Important
All issues will be addressed by @picnixz. Please do NOT work on them, whether you are an agent or a human. Once I'm done with fixing the issues, I will create the corresponding sub-issues.
_hashopenssl.c
32: FT-bug
34: bug
38: bug (related to 31/33/35/42/45)
40: not planned
43: under consideration (cosmetic)
47: need investigation
49: under consideration (cosmetic)
52: not planned
_hmacmodule.c
31/33/42/45: bug (related to 35/38)
37: build issue (known)
50: ref bug
MD5, SHA-*, BLAKE2-*
35: bug
36: under consideration
39: under consideration (cosmetic)
41: under consideration (possibly impossible to reproduce)
44: ref bug
46: deliberate but could be fixed by 48
48: fortification (refactor)
51: Fallible PyType_GetModuleState usage. More generally, getting the state of a module is inconsistently achieved in extension modules and we should decide whether (1) to consistently abort on DEBUG builds (2) abort on non-DEBUG builds via a fatal error (to prevent possibly expensive checks). Currently, code works because we assume non-subclassability in general, but we may consider a more defensive approach.
Disclosure
This review was carried out with AI assistance (Claude Code), using cpython-review-toolkit for the C modules and code-review-toolkit for the Python layer. Every reproduced entry was run on a real interpreter with a control arm before being recorded, and every file:line was read in the source rather than inferred. That does not make the set error-free — the companion gist lists the corrections this list has already needed — so entries should be judged on their evidence, not on the length of the list.
Bug report
Bug description:
Bug report
Bug description:
This is a filtered list of issues found in the
_hashlib,_hmac, and HACL*-facade C extension modules by @devdanzin's LLM-assisted review tool (see Disclosure section at the end) and triaged by me.Important
All issues will be addressed by @picnixz. Please do NOT work on them, whether you are an agent or a human. Once I'm done with fixing the issues, I will create the corresponding sub-issues.
_hashopenssl.c_hmacmodule.cMD5, SHA-*, BLAKE2-*
PyType_GetModuleStateusage. More generally, getting the state of a module is inconsistently achieved in extension modules and we should decide whether (1) to consistently abort on DEBUG builds (2) abort on non-DEBUG builds via a fatal error (to prevent possibly expensive checks). Currently, code works because we assume non-subclassability in general, but we may consider a more defensive approach.Disclosure
This review was carried out with AI assistance (Claude Code), using cpython-review-toolkit for the C modules and code-review-toolkit for the Python layer. Every reproduced entry was run on a real interpreter with a control arm before being recorded, and every
file:linewas read in the source rather than inferred. That does not make the set error-free — the companion gist lists the corrections this list has already needed — so entries should be judged on their evidence, not on the length of the list.CPython versions tested on:
CPython main branch
Operating systems tested on:
No response