Reject unsafe HMAC copy() (F-5428)

_Hmac inherited _Hash.copy(), which - lacking a wolfCrypt copy function
for Hmac - fell back to a byte-level memmove and returned an object
marked _shallow_copy that aliases the original's internal C state. In
async or hardware-accelerated builds those internal pointers are shared,
so freeing the original leaves the copy with stale state
(use-after-free, wrong MACs, or corruption). wolfCrypt exposes no safe
public Hmac copy, so override copy() to raise NotImplementedError.
digest()/hexdigest() are unaffected. Update the shared hash tests to
expect this for HMAC.

tests/test_hashes.py

@@ -172,18 +172,24 @@ def test_hash(hash_cls, vectors):
     assert hash_obj.hexdigest() == digest
 
     # copy
-    hash_obj = hash_new(hash_cls)
-    copy = hash_obj.copy()
+    if hash_cls in hmac_params:
+        # HMAC copy is intentionally unsupported (see F-5428): wolfCrypt has
+        # no safe copy and byte-copying would alias the original's C state.
+        with pytest.raises(NotImplementedError):
+            hash_new(hash_cls).copy()
+    else:
+        hash_obj = hash_new(hash_cls)
+        copy = hash_obj.copy()
 
-    assert hash_obj.hexdigest() == copy.hexdigest()
+        assert hash_obj.hexdigest() == copy.hexdigest()
 
-    hash_obj.update("wolfcrypt")
+        hash_obj.update("wolfcrypt")
 
-    assert hash_obj.hexdigest() != copy.hexdigest()
+        assert hash_obj.hexdigest() != copy.hexdigest()
 
-    copy.update("wolfcrypt")
+        copy.update("wolfcrypt")
 
-    assert hash_obj.hexdigest() == copy.hexdigest() == digest
+        assert hash_obj.hexdigest() == copy.hexdigest() == digest
 
 
 def test_hash_repeated_construction_destruction(hash_cls, vectors):
@@ -198,6 +204,9 @@ def test_hash_repeated_construction_destruction(hash_cls, vectors):
 
 def test_hash_copy_destroy_lifecycle(hash_cls, vectors):
     import gc
+    if hash_cls in hmac_params:
+        # HMAC does not support copy() (see F-5428).
+        pytest.skip("HMAC copy is not supported")
     digest = vectors[hash_cls].digest
     for _ in range(100):
         h = hash_new(hash_cls, "wolfcrypt")

tests/test_hmac_copy.py

@@ -0,0 +1,59 @@
+# -*- coding: utf-8 -*-
+#
+# test_hmac_copy.py
+#
+# Copyright (C) 2006-2022 wolfSSL Inc.
+#
+# This file is part of wolfSSL. (formerly known as CyaSSL)
+#
+# wolfSSL is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# wolfSSL is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+
+# pylint: disable=missing-docstring, import-error
+
+import pytest
+from wolfcrypt._ffi import lib as _lib
+
+pytestmark = pytest.mark.skipif(
+    not (_lib.HMAC_ENABLED and _lib.SHA256_ENABLED),
+    reason="HMAC-SHA256 not enabled")
+
+KEY = b"wolfCrypt is the best crypto around"
+
+
+def test_hmac_copy_raises_not_implemented():
+    """
+    F-5428: _Hmac inherited _Hash.copy(), which for HMAC fell back to a
+    byte-level memmove and returned an object aliasing the original's C
+    state (use-after-free risk in async/HW builds). wolfCrypt has no safe
+    public copy, so HMAC copy() must refuse rather than alias.
+    """
+    from wolfcrypt.hashes import HmacSha256
+
+    hmac = HmacSha256.new(KEY, b"some message")
+    with pytest.raises(NotImplementedError):
+        hmac.copy()
+
+
+def test_hmac_digest_unaffected_by_copy_removal():
+    """digest()/hexdigest() must keep working and remain repeatable."""
+    from wolfcrypt.hashes import HmacSha256
+
+    hmac = HmacSha256.new(KEY, b"some message")
+    first = hmac.hexdigest()
+    second = hmac.hexdigest()
+    assert first == second
+
+    hmac.update(b" more")
+    assert hmac.hexdigest() != first

wolfcrypt/hashes.py

@@ -392,19 +392,22 @@ if _lib.HMAC_ENABLED:
         A **PEP 247: Cryptographic Hash Functions** compliant
         **Keyed Hash Function Interface**.
 
-        Note: wolfSSL does not provide a `wc_HmacCopy` equivalent, so
-        `copy()` falls back to a byte-level memmove. In default builds the
-        Hmac struct is self-contained and this is safe. In async or
-        hardware-accelerated builds where the struct contains internal
-        pointers, the copy shares those pointers with the original; the
-        copy must not outlive the original or be used after the original
-        is freed.
+        Note: wolfCrypt provides no safe public copy for an `Hmac` object.
+        Byte-copying the struct would alias the original's internal state
+        (e.g. async/hardware-accelerated builds keep pointers there), so
+        `copy()` is not supported and raises `NotImplementedError`.
         """
         digest_size = None
         _native_type = "Hmac *"
         _native_size = _ffi.sizeof("Hmac")
         _delete = staticmethod(_lib.wc_HmacFree)
 
+        def copy(self):
+            raise NotImplementedError(
+                "HMAC objects cannot be safely copied: wolfCrypt has no "
+                "wc_HmacCopy and byte-copying the state would alias the "
+                "original's internal C resources")
+
         def __del__(self):
             if hasattr(self, '_native_object') and not getattr(self, '_shallow_copy', False):
                 self._delete(self._native_object)