crypto: prevent Hmac.digest() from returning uninitialized memory

Hmac.prototype._flush was aliased to Hash.prototype._flush, which
finalizes the native HMAC context but never sets the JavaScript-side
kFinalized flag. After an Hmac has been used as a stream, a subsequent
Hmac.prototype.digest() call therefore still believes the object has not
been finalized and calls into C++ a second time. On that second call the
native context has already been reset, so the digest buffer is never
written and Digest::MAX_SIZE bytes of uninitialized stack memory are
returned to JavaScript.

Hash is not affected because Hash::HashDigest caches its digest
(refs #28245); Hmac never received the equivalent protection.

Give Hmac its own _flush that sets kFinalized so repeat digest() calls
after stream use are handled by the existing DEP0206 guard. As defense
in depth, also set buf.len = 0 on the native side when the context has
already been reset so unwritten bytes can never be emitted.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #65112
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

Author: mcollina

lib/internal/crypto/hash.js

@@ -245,7 +245,12 @@ Hmac.prototype.digest = function digest(outputEncoding) {
   return ret;
 };
 
-Hmac.prototype._flush = Hash.prototype._flush;
+Hmac.prototype._flush = function _flush(callback) {
+  this.push(this[kHandle].digest());
+  this[kState][kFinalized] = true; // This diverges from Hash.prototype._flush:
+  // Hash instances are still usable after a flush, Hmac are not, see DEP0206.
+  callback();
+};
 Hmac.prototype._transform = Hash.prototype._transform;
 
 // Implementation for WebCrypto subtle.digest()

src/crypto/crypto_hmac.cc

@@ -141,6 +141,9 @@ void Hmac::HmacDigest(const FunctionCallbackInfo<Value>& args) {
       return ThrowCryptoError(env, ERR_get_error(), "Failed to finalize HMAC");
     }
     hmac->ctx_.reset();
+  } else {
+    // The context has already been finalized; never emit unwritten bytes.
+    buf.len = 0;
   }
 
   Local<Value> ret;

test/parallel/test-crypto-hmac.js

@@ -312,6 +312,26 @@ for (let i = 0, l = rfc4231.length; i < l; i++) {
   }
 }
 
+// Calling digest() after the Hmac has already been used as a stream must
+// return an empty buffer (the DEP0206 repeat-digest guard), not uninitialized
+// stack memory. The stream itself must still produce the correct digest.
+// See: https://github.com/nodejs/node/issues/28245
+{
+  const key = 'key';
+  const data = 'some data to hash';
+
+  const streamHmac = crypto.createHmac('sha256', key);
+  streamHmac.end(data);
+  const streamDigest = streamHmac.read();
+
+  // digest() after the stream already finalized must not return garbage.
+  assert.deepStrictEqual(streamHmac.digest(), Buffer.alloc(0));
+
+  // Sanity check: the stream itself produced the correct digest.
+  const expected = crypto.createHmac('sha256', key).update(data).digest();
+  assert.deepStrictEqual(streamDigest, expected);
+}
+
 // Test HMAC-MD5/SHA1 (rfc 2202 Test Cases)
 const rfc2202_md5 = [
   {