Merge pull request #253 from dreid/hash-raise-after-finalize

raise an exception if you try to use a HashContext after finalize is called.

2 files changed, 12 insertions, 1 deletions

diff --git a/cryptography/exceptions.py b/cryptography/exceptions.py
index 391bed82..c2e71493 100644
--- a/cryptography/exceptions.py
+++ b/cryptography/exceptions.py
@@ -14,3 +14,7 @@
 
 class UnsupportedAlgorithm(Exception):
     pass
+
+
+class AlreadyFinalized(Exception):
+    pass
diff --git a/cryptography/hazmat/primitives/hashes.py b/cryptography/hazmat/primitives/hashes.py
index 3bd3ad46..b8de6c4b 100644
--- a/cryptography/hazmat/primitives/hashes.py
+++ b/cryptography/hazmat/primitives/hashes.py
@@ -15,6 +15,7 @@ from __future__ import absolute_import, division, print_function
 
 import six
 
+from cryptography.exceptions import AlreadyFinalized
 from cryptography.hazmat.primitives import interfaces
 
 
@@ -37,17 +38,23 @@ class Hash(object):
             self._ctx = ctx
 
     def update(self, data):
+        if self._ctx is None:
+            raise AlreadyFinalized()
         if isinstance(data, six.text_type):
             raise TypeError("Unicode-objects must be encoded before hashing")
         self._ctx.update(data)
 
     def copy(self):
+        if self._ctx is None:
+            raise AlreadyFinalized()
         return Hash(
             self.algorithm, backend=self._backend, ctx=self._ctx.copy()
         )
 
     def finalize(self):
-        return self._ctx.finalize()
+        digest = self._ctx.finalize()
+        self._ctx = None
+        return digest
 
 
 @interfaces.register(interfaces.HashAlgorithm)