Promote BLOCK_SIZE assertion to hard assert
What the developer wrote
Authored by Jamil Lambert, PhD
Promote BLOCK_SIZE assertion to hard assert
The debug_assert only fires in debug builds; a downstream HashEngine
implementation with BLOCK_SIZE > 128 would silently produce wrong
outputs in release builds by indexing into fixed-size 128-byte ipad/opad
buffers beyond their length.
Change to assert! so the check is unconditional.
Assisted-by: claude-sonnet-4.6
What changed, and why it matters
This commit fixes a safety check in the HMAC code. Previously, the code only verified in debug builds that a hash engine's block size did not exceed 128 bytes. In release builds, an oversized block size would cause the code to write past the end of fixed 128-byte internal buffers, leading to incorrect HMAC results or memory corruption. The fix makes this check run unconditionally by changing a debug-only assertion into a regular assertion.
Upgrade to a version containing this commit. If you maintain a custom HashEngine, ensure BLOCK_SIZE remains <= 128. No immediate active exploitation is indicated, but treat this as a hardening fix for a latent safety bug.
Security signals we found
Buffer overflow / out-of-bounds write potential from unchecked block size
Debug-only invariant relied upon for memory safety
Incorrect cryptographic output possible in release builds
Defense-in-depth hardening of HMAC implementation
Evidence from the diff
In hashes/src/hmac/mod.rs, the HmacEngine constructor used debug_assert!(T::BLOCK_SIZE <= 128) before indexing into fixed 128-byte ipad and opad arrays. Because debug_assert is stripped in release builds, a custom HashEngine with BLOCK_SIZE > 128 would silently overflow these stack buffers. The patch replaces debug_assert! with assert!, enforcing the bound in all build configurations.
Changed components
hashes/src/hmac/mod.rsHmacEngine<T>HashEngine trait implementations with custom BLOCK_SIZEInspect captured patch +1 / −1
diff --git a/hashes/src/hmac/mod.rs b/hashes/src/hmac/mod.rs
index 3e3b9606..0f8c0eb1 100644
--- a/hashes/src/hmac/mod.rs
+++ b/hashes/src/hmac/mod.rs
@@ -99,7 +99,7 @@ impl<T: HashEngine> HmacEngine<T> {
where
T: Default,
{
- debug_assert!(T::BLOCK_SIZE <= 128);
+ assert!(T::BLOCK_SIZE <= 128);
let mut ipad = [0x36u8; 128];
let mut opad = [0x5cu8; 128];
Why this scored 60/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.