Issue #14888: Fix misbehaviour of the _md5 module when called on data larger than 2**32 bytes.

1 files changed, 14 insertions, 3 deletions

diff --git a/Modules/md5module.c b/Modules/md5module.c
index 0683ef50ba..3461623086 100644
--- a/Modules/md5module.c
+++ b/Modules/md5module.c
@@ -262,6 +262,8 @@ MD5_new(PyObject *self, PyObject *args)
 {
     md5object *md5p;
     Py_buffer view = { 0 };
+    Py_ssize_t n;
+    unsigned char *buf;
 
     if (!PyArg_ParseTuple(args, "|s*:new", &view))
         return NULL;
@@ -271,9 +273,18 @@ MD5_new(PyObject *self, PyObject *args)
         return NULL;
     }
 
-    if (view.len > 0) {
-        md5_append(&md5p->md5, (unsigned char*)view.buf,
-               Py_SAFE_DOWNCAST(view.len, Py_ssize_t, unsigned int));
+    n = view.len;
+    buf = (unsigned char *) view.buf;
+    while (n > 0) {
+        Py_ssize_t nbytes;
+        if (n > INT_MAX)
+            nbytes = INT_MAX;
+        else
+            nbytes = n;
+        md5_append(&md5p->md5, buf,
+                   Py_SAFE_DOWNCAST(nbytes, Py_ssize_t, unsigned int));
+        buf += nbytes;
+        n -= nbytes;
     }
     PyBuffer_Release(&view);