qa: Add pragma: no cover to untestable code

This patch adds the `no cover` pragma to:

- out-of-memory code handling after failed malloc;
- old-style ABC handling with `raise NotImplementedError()`;
- more Python 2/Python 3 compatible imports.

This requires a patch to Cython.Coverage:

  cython/cython#3682

src/mbedtls/_md.pyx

@@ -117,23 +117,23 @@ cdef class MDBase:
         return _md.mbedtls_md_get_name(self._info).decode("ascii").lower()
 
     cdef _finish(self, const unsigned char *output):
-        return -0x5100  # Bad input data error.
+        raise NotImplementedError()  # pragma: no cover
 
     def update(self, const unsigned char[:] buffer not None):
-        return -0x5100  # Bad input data error.
+        raise NotImplementedError()  # pragma: no cover
 
     def digest(self):
         """Return the digest output of `message`."""
         cdef size_t sz = self.digest_size
         cdef unsigned char* output = <unsigned char*>malloc(
             sz * sizeof(unsigned char))
         if not output:
-            raise MemoryError()
+            raise MemoryError()  # pragma: no cover
         try:
             _exc.check_error(self._finish(output))
             return output[:self.digest_size]
         finally:
-            free(output)
+            free(output)  # pragma: no cover
 
     def hexdigest(self):
         """Like digest except the digest is returned as a string object
@@ -144,7 +144,7 @@ cdef class MDBase:
 
     def copy(self):
         """Return a copy ("clone") of the MD object."""
-        raise NotImplementedError
+        raise NotImplementedError()  # pragma: no cover
 
 
 cdef class Hash(_md.MDBase):

src/mbedtls/_random.pyx

@@ -39,12 +39,12 @@ cdef class _Entropy:
             length * sizeof(unsigned char)
         )
         if not output:
-            raise MemoryError()
+            raise MemoryError()  # pragma: no cover
         try:
             check_error(_rnd.mbedtls_entropy_func(&self._ctx, output, length))
             return output[:length]
         finally:
-            free(output)
+            free(output)  # pragma: no cover
 
     def update(self, const unsigned char[:] data):
         """Add data to the accumulator manually."""
@@ -94,7 +94,7 @@ cdef class Random:
             length * sizeof(unsigned char)
         )
         if not output:
-            raise MemoryError()
+            raise MemoryError()  # pragma: no cover
         try:
             check_error(
                 _rnd.mbedtls_ctr_drbg_random(&self._ctx, output, length)
@@ -103,7 +103,7 @@ cdef class Random:
             _plt.mbedtls_platform_zeroize(output, length)
             return ret
         finally:
-            free(output)
+            free(output)  # pragma: no cover
 
     def randbelow(self, upper_bound):
         """Return a random int in the range [0, n).

src/mbedtls/_ringbuf.pyx

@@ -24,7 +24,7 @@ cdef c_init(_rb.ring_buffer_ctx *ctx, size_t maxlen):
     ctx._size = maxlen + 1
     ctx.buf = <unsigned char *>malloc(ctx._size * sizeof(unsigned char))
     if not ctx.buf:
-        raise MemoryError()
+        raise MemoryError()  # pragma: no cover
     ctx.head = ctx.tail = ctx.buf
 
 
@@ -61,12 +61,12 @@ cdef c_peek(ring_buffer_ctx *ctx, size_t amt):
     cdef unsigned char *dst = <unsigned char *>malloc(
         min(amt, c_len(ctx) * sizeof(unsigned char)))
     if not dst:
-        raise MemoryError()
+        raise MemoryError()  # pragma: no cover
     try:
         nread = c_peekinto(ctx, dst, amt)
         return bytes(dst[:nread])
     finally:
-        free(dst)
+        free(dst)  # pragma: no cover
 
 
 @cython.boundscheck(False)
@@ -91,12 +91,12 @@ cdef c_read(ring_buffer_ctx *ctx, size_t amt):
     cdef unsigned char *dst = <unsigned char *>malloc(
         min(amt, c_len(ctx)) * sizeof(unsigned char))
     if not dst:
-        raise MemoryError()
+        raise MemoryError()  # pragma: no cover
     try:
         nread = c_readinto(ctx, dst, amt)
         return bytes(dst[:nread])
     finally:
-        free(dst)
+        free(dst)  # pragma: no cover
 
 
 @cython.boundscheck(False)

src/mbedtls/cipher/_cipher.pyx

@@ -8,11 +8,11 @@
 cimport mbedtls.cipher._cipher as _cipher
 from libc.stdlib cimport malloc, free
 
-try:
+import sys as _sys
+if _sys.version_info > (3, 4):
     from contextlib import suppress
-except ImportError:
-    # Python 2.7
-    from contextlib2 import suppress
+else:
+    from contextlib2 import suppress  # pragma: no cover
 
 import enum
 
@@ -250,10 +250,10 @@ cdef class _CipherBase:
         return _cipher.mbedtls_cipher_get_key_bitlen(&self._enc_ctx) // 8
 
     def encrypt(self, const unsigned char[:] message not None):
-        raise NotImplementedError
+        raise NotImplementedError()  # pragma: no cover
 
     def decrypt(self, const unsigned char[:] message not None):
-        raise NotImplementedError
+        raise NotImplementedError()  # pragma: no cover
 
 
 cdef class Cipher(_CipherBase):
@@ -269,7 +269,7 @@ cdef class Cipher(_CipherBase):
         cdef unsigned char* output = <unsigned char*>malloc(
             sz * sizeof(unsigned char))
         if not output:
-            raise MemoryError()
+            raise MemoryError()  # pragma: no cover
         try:
             # We can call `check_error` directly here because we return a
             # python object.
@@ -280,7 +280,7 @@ cdef class Cipher(_CipherBase):
                 &input[0], input.size, output, &olen))
             return output[:olen]
         finally:
-            free(output)
+            free(output)  # pragma: no cover
 
     def encrypt(self, const unsigned char[:] message not None):
         return self._crypt(self._iv, message, _cipher.MBEDTLS_ENCRYPT)
@@ -313,7 +313,7 @@ cdef class AEADCipher(_CipherBase):
         cdef unsigned char* output = <unsigned char*>malloc(
             sz * sizeof(unsigned char))
         if not output:
-            raise MemoryError()
+            raise MemoryError()  # pragma: no cover
         try:
             if ad.size:
                 pad = <const unsigned char*> &ad[0]
@@ -326,7 +326,7 @@ cdef class AEADCipher(_CipherBase):
                 tag, sizeof(tag)))
             return output[:olen], tag[:16]
         finally:
-            free(output)
+            free(output)  # pragma: no cover
 
     cdef _aead_decrypt(self,
                 const unsigned char[:] iv,
@@ -342,7 +342,7 @@ cdef class AEADCipher(_CipherBase):
         cdef unsigned char* output = <unsigned char*>malloc(
             sz * sizeof(unsigned char))
         if not output:
-            raise MemoryError()
+            raise MemoryError()  # pragma: no cover
         try:
             if ad.size:
                 pad = <const unsigned char*> &ad[0]
@@ -355,7 +355,7 @@ cdef class AEADCipher(_CipherBase):
                 &tag[0], tag.size))
             return output[:olen]
         finally:
-            free(output)
+            free(output)  # pragma: no cover
 
     def encrypt(self, const unsigned char[:] message not None):
         return self._aead_encrypt(self._iv, self._ad, message)

src/mbedtls/exceptions.pyx

@@ -31,7 +31,7 @@ class TLSError(Exception):
         cdef size_t buflen = 200
         cdef char* buffer = <char*>malloc(buflen * sizeof(char))
         if not buffer:
-            raise MemoryError()
+            raise MemoryError()  # pragma: no cover
         try:
             _exc.mbedtls_strerror(self.err, &buffer[0], buflen)
             output = bytes(buffer[:buflen])
@@ -41,7 +41,7 @@ class TLSError(Exception):
                 olen = buflen
             return output[:olen].decode("ascii")
         finally:
-            free(buffer)
+            free(buffer)  # pragma: no cover
 
     def __str__(self):
         if self.err is None:

src/mbedtls/hkdf.pyx

@@ -48,7 +48,7 @@ def hkdf(
         length * sizeof(unsigned char)
     )
     if not okm:
-        raise MemoryError()
+        raise MemoryError()  # pragma: no cover
     try:
         _exc.check_error(_hkdf.mbedtls_hkdf(
             hmac._info,
@@ -61,7 +61,7 @@ def hkdf(
         ))
         return okm[:length]
     finally:
-        free(okm)
+        free(okm)  # pragma: no cover
 
 
 def extract(
@@ -94,7 +94,7 @@ def extract(
         hmac.digest_size * sizeof(unsigned char)
     )
     if not prk:
-        raise MemoryError()
+        raise MemoryError()  # pragma: no cover
     try:
         _exc.check_error(_hkdf.mbedtls_hkdf_extract(
             hmac._info,
@@ -105,7 +105,7 @@ def extract(
         ))
         return prk[:hmac.digest_size]
     finally:
-        free(prk)
+        free(prk)  # pragma: no cover
 
 
 def expand(
@@ -139,7 +139,7 @@ def expand(
         length * sizeof(unsigned char)
     )
     if not okm:
-        raise MemoryError()
+        raise MemoryError()  # pragma: no cover
     try:
         _exc.check_error(_hkdf.mbedtls_hkdf_expand(
             hmac._info,
@@ -150,4 +150,4 @@ def expand(
         ))
         return okm[:length]
     finally:
-        free(okm)
+        free(okm)  # pragma: no cover

src/mbedtls/mpi.pxd

@@ -113,7 +113,7 @@ cdef class MPI:
     cdef size_t _len(self)
 
 
-cdef inline from_mpi(mbedtls_mpi *c_mpi):
+cdef inline from_mpi(mbedtls_mpi *c_mpi):  # pragma: no cover
     new_mpi = MPI()
     mbedtls_mpi_copy(&new_mpi._ctx, c_mpi)
     return new_mpi

src/mbedtls/mpi.pyx

@@ -98,15 +98,15 @@ cdef class MPI:
         cdef unsigned char* output = <unsigned char*>malloc(
             length * sizeof(unsigned char))
         if not output:
-            raise MemoryError()
+            raise MemoryError()  # pragma: no cover
         try:
             _exc.check_error(_mpi.mbedtls_mpi_write_binary(
                 &self._ctx, output, length))
             return output[:length][::-1 if byteorder == "little" else 1]
         except Exception as exc:
             raise OverflowError from exc
         finally:
-            free(output)
+            free(output)  # pragma: no cover
 
     __bytes__ = to_bytes