[3.14] gh-155428: align hmac.digest and hmac.HMAC.digest outputs when using small block sizes (GH-155429) (#160061)

gh-155428: align `hmac.digest` and `hmac.HMAC.digest` outputs when using  small block sizes (GH-155429)
(cherry picked from commit 815dc47)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Author: miss-islington

Lib/hmac.py

@@ -39,6 +39,27 @@ def digest_wrapper(d=b''):
     return digest_wrapper
 
 
+def _select_blocksize(obj, default, stacklevel=3):
+    if hasattr(obj, 'block_size'):
+        blocksize = obj.block_size
+        if blocksize < 16:
+            import warnings
+
+            warnings.warn(f"block_size of {blocksize} seems too small; "
+                          f"using our default of {default}.",
+                          RuntimeWarning, stacklevel=stacklevel)
+            blocksize = default
+    else:
+        import warnings
+
+        warnings.warn("No block_size attribute on given digest object; "
+                      f"Assuming {default}.",
+                      RuntimeWarning, stacklevel=stacklevel)
+        blocksize = default
+    return blocksize
+
+
+
 class HMAC:
     """RFC 2104 HMAC class.  Also complies with RFC 4231.
 
@@ -106,28 +127,14 @@ def _init_builtin_hmac(self, key, msg, digestmod):
         self.block_size = self._hmac.block_size
 
     def _init_old(self, key, msg, digestmod):
-        import warnings
-
         digest_cons = _get_digest_constructor(digestmod)
 
         self._hmac = None
         self._outer = digest_cons()
         self._inner = digest_cons()
         self.digest_size = self._inner.digest_size
 
-        if hasattr(self._inner, 'block_size'):
-            blocksize = self._inner.block_size
-            if blocksize < 16:
-                warnings.warn(f"block_size of {blocksize} seems too small; "
-                              f"using our default of {self.blocksize}.",
-                              RuntimeWarning, 2)
-                blocksize = self.blocksize  # pragma: no cover
-        else:
-            warnings.warn("No block_size attribute on given digest object; "
-                          f"Assuming {self.blocksize}.",
-                          RuntimeWarning, 2)
-            blocksize = self.blocksize  # pragma: no cover
-
+        blocksize = _select_blocksize(self._inner, self.blocksize)
         if len(key) > blocksize:
             key = digest_cons(key).digest()
 
@@ -261,7 +268,7 @@ def _compute_digest_fallback(key, msg, digest):
     digest_cons = _get_digest_constructor(digest)
     inner = digest_cons()
     outer = digest_cons()
-    blocksize = getattr(inner, 'block_size', 64)
+    blocksize = _select_blocksize(inner, HMAC.blocksize)
     if len(key) > blocksize:
         key = digest_cons(key).digest()
     key = key.ljust(blocksize, b'\0')

Lib/test/test_hmac.py

@@ -1494,17 +1494,36 @@ def update(self, v):
                 self._x.update(v)
             def digest(self):
                 return self._x.digest()
+            def copy(self):
+                h = MockCrazyHash()
+                h._x = self._x.copy()
+                return h
 
         with warnings.catch_warnings():
             warnings.simplefilter('error', RuntimeWarning)
             with self.assertRaises(RuntimeWarning):
                 hmac.HMAC(b'a', b'b', digestmod=MockCrazyHash)
                 self.fail('Expected warning about missing block_size')
+            with self.assertRaises(RuntimeWarning):
+                hmac.digest(b'a', b'b', MockCrazyHash)
+                self.fail('Expected warning about missing block_size')
 
             MockCrazyHash.block_size = 1
             with self.assertRaises(RuntimeWarning):
                 hmac.HMAC(b'a', b'b', digestmod=MockCrazyHash)
                 self.fail('Expected warning about small block_size')
+            with self.assertRaises(RuntimeWarning):
+                hmac.digest(b'a', b'b', MockCrazyHash)
+                self.fail('Expected warning about small block_size')
+
+        # gh-155428: hmac.HMAC() and hmac.digest() must both
+        # fall back to the default block size (64 for SHA-256).
+        expect = hmac.digest(b'a', b'b', 'sha256')
+        with warnings.catch_warnings():
+            warnings.simplefilter('ignore', RuntimeWarning)
+            h = hmac.HMAC(b'a', b'b', digestmod=MockCrazyHash)
+            self.assertEqual(h.digest(), expect)
+            self.assertEqual(hmac.digest(b'a', b'b', MockCrazyHash), expect)
 
     @hashlib_helper.requires_hashdigest('sha256')
     def test_with_fallback(self):

Misc/NEWS.d/next/Library/2026-08-09-14-26-48.gh-issue-155428.wi0_fI.rst

@@ -0,0 +1,3 @@
+Ensure that :func:`hmac.digest` and :meth:`hmac.HMAC.digest` output
+identical values when using a digest's block size smaller than 16. Patch by
+Bénédikt Tran.