fix(hmac): snapshot signatures before async verification

lib/src/impl_ffi/impl_ffi.hmac.dart

@@ -165,7 +165,18 @@ final class _HmacSecretKeyImpl implements HmacSecretKeyImpl {
       verifyStream(signature, Stream.value(data));
 
   @override
-  Future<bool> verifyStream(List<int> signature, Stream<List<int>> data) async {
+  Future<bool> verifyStream(List<int> signature, Stream<List<int>> data) {
+    // Snapshot caller-owned input before any asynchronous work. This matches
+    // Web Crypto semantics and keeps verification independent of mutations to
+    // the original list while the data stream is being consumed.
+    final signatureSnapshot = List<int>.of(signature, growable: false);
+    return _verifySignatureStream(signatureSnapshot, data);
+  }
+
+  Future<bool> _verifySignatureStream(
+    List<int> signature,
+    Stream<List<int>> data,
+  ) async {
     final other = await signStream(data);
     if (signature.length != other.length) {
       return false;

lib/src/impl_js/impl_js.hmac.dart

@@ -164,7 +164,15 @@ final class _HmacSecretKeyImpl implements HmacSecretKeyImpl {
   }
 
   @override
-  Future<bool> verifyStream(List<int> signature, Stream<List<int>> data) async {
+  Future<bool> verifyStream(List<int> signature, Stream<List<int>> data) {
+    final signatureSnapshot = List<int>.of(signature, growable: false);
+    return _verifySignatureStream(signatureSnapshot, data);
+  }
+
+  Future<bool> _verifySignatureStream(
+    List<int> signature,
+    Stream<List<int>> data,
+  ) async {
     return await verifyBytes(signature, await _bufferStream(data));
   }
 

lib/src/testing/regression/hmac_signature_snapshot.dart

@@ -0,0 +1,92 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import 'dart:async';
+
+import 'package:webcrypto/webcrypto.dart';
+
+import '../utils/utils.dart';
+
+void main() => tests().runTests();
+
+List<({String name, Future<void> Function() test})> tests() {
+  final tests = <({String name, Future<void> Function() test})>[];
+  void test(String name, Future<void> Function() fn) =>
+      tests.add((name: name, test: fn));
+
+  test('Hmac: verifyStream snapshots an invalid signature', () async {
+    final key = await HmacSecretKey.importRawKey(
+      List<int>.filled(32, 7),
+      Hash.sha256,
+    );
+    final data = List<int>.filled(128, 3);
+    final signature = await key.signBytes(data);
+    signature[0] ^= 1;
+
+    final controller = StreamController<List<int>>();
+    final pending = key.verifyStream(signature, controller.stream);
+
+    // Restore the valid bytes while verification is waiting for stream data.
+    signature[0] ^= 1;
+    controller.add(data);
+    await controller.close();
+
+    check(
+      !await pending,
+      'verification must use the invalid signature supplied at invocation',
+    );
+  });
+
+  test('Hmac: verifyStream snapshots a valid signature', () async {
+    final key = await HmacSecretKey.importRawKey(
+      List<int>.filled(32, 7),
+      Hash.sha256,
+    );
+    final data = List<int>.filled(128, 3);
+    final signature = await key.signBytes(data);
+
+    final controller = StreamController<List<int>>();
+    final pending = key.verifyStream(signature, controller.stream);
+
+    // Corrupt the caller-owned list while verification is waiting.
+    signature[0] ^= 1;
+    controller.add(data);
+    await controller.close();
+
+    check(
+      await pending,
+      'verification must use the valid signature supplied at invocation',
+    );
+  });
+
+  test('Hmac: verifyBytes snapshots the signature at invocation', () async {
+    final key = await HmacSecretKey.importRawKey(
+      List<int>.filled(32, 7),
+      Hash.sha256,
+    );
+    final data = List<int>.filled(50000, 3);
+    final signature = await key.signBytes(data);
+    signature[0] ^= 1;
+
+    final pending = key.verifyBytes(signature, data);
+    signature[0] ^= 1;
+
+    check(
+      !await pending,
+      'verifyBytes must not observe a later signature mutation',
+    );
+  });
+
+  return tests;
+}

lib/src/testing/testing.dart

@@ -31,6 +31,7 @@ import 'webcrypto/rsassapkcs1v15.dart' as rsassapkcs1v15;
 import 'webcrypto/random.dart' as random;
 import 'webcrypto/digest.dart' as digest;
 import 'regression/issue_302_hmac_jwk_length.dart' as issue_302_hmac_jwk_length;
+import 'regression/hmac_signature_snapshot.dart' as hmac_signature_snapshot;
 import 'regression/aes_gcm_invalid_tag_length.dart'
     as aes_gcm_invalid_tag_length;
 import 'regression/derive_bits_zero_length.dart' as derive_bits_zero_length;
@@ -69,6 +70,7 @@ void runAllTests(
     ...random.tests(),
     ...digest.tests(),
     ...issue_302_hmac_jwk_length.tests(),
+    ...hmac_signature_snapshot.tests(),
     ...aes_gcm_invalid_tag_length.tests(),
     ...ecdh_derive_bits.tests(),
     ...issue_60_trailing_bytes.tests(),