"""Reproducer for gh-149816 finding (21): "Racy EVP_MD cache overwrite leaks
references in Modules/_hashopenssl.c" — the bug fixed by PR gh-153019.

Buggy code (get_openssl_evp_md_by_utf8name, pre-fix):

    digest = FT_ATOMIC_LOAD_PTR_RELAXED(entry->evp);   // slot starts NULL
    if (digest == NULL) {
        digest = PY_EVP_MD_fetch(entry->ossl_name, NULL);        // slow fetch, +1
        other_digest = _Py_atomic_exchange_ptr(&entry->evp, digest);
    }
    ...
    assert(other_digest == NULL || other_digest == digest);
    if (digest != NULL && other_digest == NULL)
        PY_EVP_MD_up_ref(digest);

The race window is the whole EVP_MD_fetch() call. If several threads hit the
FIRST use of an uncached digest simultaneously, they all read the slot as NULL,
all fetch, and all atomic-exchange. Every store past the first overwrites (and
leaks) the previous thread's freshly fetched digest: `other_digest` is that
extra reference, and it is never freed.

OpenSSL's method store makes EVP_MD_fetch return the *same* refcounted pointer
across threads, so `other_digest == digest` (the assert never fires) and the
leak is a refcount inflation on a still-reachable object — invisible to TSan,
ASan, and LSan. That is why this finding had no reproducer. To observe it, build
_hashopenssl.c with -DHASHLIB_EVP_RACE_COUNTER (see hashlib_evp_race_counter.patch),
which exposes _hashlib._evp_md_race_events().

Requires: free-threaded build, OpenSSL 3.0+. Under PYTHON_GIL=1 / -X gil=1 the
race cannot occur and the counter stays 0.

Usage:
    ./python repro_ft_hashopenssl_race.py           # free-threaded: race events > 0
    ./python -X gil=1 repro_ft_hashopenssl_race.py  # serialized:    race events == 0
"""
import sys
import threading

import _hashlib  # use the C module directly; don't let hashlib pre-touch slots

# Names backed by entries in _hashopenssl.c's py_hashes[] table (each has two
# lazily-filled cache slots: evp [usedforsecurity=True] and evp_nosecurity).
NAMES = [
    "md5", "sha1", "sha224", "sha256", "sha384", "sha512",
    "sha512_224", "sha512_256",
    "sha3_224", "sha3_256", "sha3_384", "sha3_512",
    "shake_128", "shake_256", "blake2s", "blake2b",
]

NTHREADS = 64

HAS_COUNTER = hasattr(_hashlib, "_evp_md_race_events")
print("gil_enabled:", sys._is_gil_enabled(),
      "| race counter available:", HAS_COUNTER, flush=True)


# A spin barrier releases all threads within a cache-coherency delay of each
# other — far tighter than threading.Barrier's condition-variable wakeup, which
# is too staggered relative to the ~microsecond EVP_MD_fetch window.
def hammer(name, used_for_security, ready, go):
    with ready[1]:
        ready[0] += 1
    while not go[0]:  # spin until main flips the flag — near-simultaneous release
        pass
    try:
        _hashlib.new(name, b"", usedforsecurity=used_for_security)
    except ValueError:
        pass  # digest not provided by this OpenSSL build


def main():
    if HAS_COUNTER:
        _hashlib._evp_md_race_events_reset()

    windows = 0
    for name in NAMES:
        for ufs in (True, False):
            go = [False]
            ready = [0, threading.Lock()]
            ts = [
                threading.Thread(target=hammer, args=(name, ufs, ready, go))
                for _ in range(NTHREADS)
            ]
            for t in ts:
                t.start()
            while ready[0] < NTHREADS:  # wait until every thread is spinning
                pass
            go[0] = True               # release them all at once
            for t in ts:
                t.join()
            windows += 1

    print(f"done: {windows} first-touch race windows", flush=True)
    if HAS_COUNTER:
        n = _hashlib._evp_md_race_events()
        kind = "LEAKED EVP_MD refs" if n else "race events"
        print(f"race-losers: {n}  "
              f"({'BUG: ' + str(n) + ' ' + kind if n else 'none — no leak'})",
              flush=True)
        # Non-zero on a free-threaded *buggy* build; 0 when serialized or fixed.
        sys.exit(1 if n else 0)


main()