File CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch of Package python (Revision 381d91ea0ab10fc5235c75951d42564a)
Currently displaying revision 381d91ea0ab10fc5235c75951d42564a , Show latest
173
1
From 34df10a9a16b38d54421eeeaf73ec89828563be7 Mon Sep 17 00:00:00 20012
From: Benjamin Peterson <benjamin@python.org>3
Date: Mon, 18 Jan 2021 15:11:46 -06004
Subject: [PATCH] [3.6] closes bpo-42938: Replace snprintf with Python unicode5
formatting in ctypes param reprs. (GH-24250)6
7
(cherry picked from commit 916610ef90a0d0761f08747f7b0905541f0977c7)8
9
Co-authored-by: Benjamin Peterson <benjamin@python.org>10
---11
Lib/ctypes/test/test_parameters.py | 43 +++++++++++++++12
.../2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst | 2 +13
Modules/_ctypes/callproc.c | 55 +++++++------------14
3 files changed, 66 insertions(+), 34 deletions(-)15
create mode 100644 Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst16
17
--- a/Lib/ctypes/test/test_parameters.py18
+++ b/Lib/ctypes/test/test_parameters.py19
20
-import unittest, sys21
+import platform22
+import sys23
+import unittest24
from ctypes.test import need_symbol25
import test.support26
27
28
with self.assertRaises(ZeroDivisionError):29
WorseStruct().__setstate__({}, b'foo')30
31
+ def test_parameter_repr(self):32
+ from ctypes import (33
+ c_bool,34
+ c_char,35
+ c_wchar,36
+ c_byte,37
+ c_ubyte,38
+ c_short,39
+ c_ushort,40
+ c_int,41
+ c_uint,42
+ c_long,43
+ c_ulong,44
+ c_longlong,45
+ c_ulonglong,46
+ c_float,47
+ c_double,48
+ c_longdouble,49
+ c_char_p,50
+ c_wchar_p,51
+ c_void_p,52
+ )53
+ self.assertRegexpMatches(repr(c_bool.from_param(True)), r"^<cparam '\?' at 0x[A-Fa-f0-9]+>$")54
+ self.assertEqual(repr(c_char.from_param('a')), "<cparam 'c' ('a')>")55
+ self.assertRegexpMatches(repr(c_wchar.from_param('a')), r"^<cparam 'u' at 0x[A-Fa-f0-9]+>$")56
+ self.assertEqual(repr(c_byte.from_param(98)), "<cparam 'b' (98)>")57
+ self.assertEqual(repr(c_ubyte.from_param(98)), "<cparam 'B' (98)>")58
+ self.assertEqual(repr(c_short.from_param(511)), "<cparam 'h' (511)>")59
+ self.assertEqual(repr(c_ushort.from_param(511)), "<cparam 'H' (511)>")60
+ self.assertRegexpMatches(repr(c_int.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")61
+ self.assertRegexpMatches(repr(c_uint.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")62
+ self.assertRegexpMatches(repr(c_long.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")63
+ self.assertRegexpMatches(repr(c_ulong.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")64
+ if platform.architecture()[0].startswith("64"):65
+ self.assertRegexpMatches(repr(c_longlong.from_param(20000)), r"^<cparam '[liq]' \(20000\)>$")66
+ self.assertRegexpMatches(repr(c_ulonglong.from_param(20000)), r"^<cparam '[LIQ]' \(20000\)>$")67
+ self.assertEqual(repr(c_float.from_param(1.5)), "<cparam 'f' (1.5)>")68
+ self.assertEqual(repr(c_double.from_param(1.5)), "<cparam 'd' (1.5)>")69
+ self.assertEqual(repr(c_double.from_param(1e300)), "<cparam 'd' (1e+300)>")70
+ self.assertRegexpMatches(repr(c_longdouble.from_param(1.5)), r"^<cparam ('d' \(1.5\)|'g' at 0x[A-Fa-f0-9]+)>$")71
+ self.assertRegexpMatches(repr(c_char_p.from_param(b'hihi')), "^<cparam 'z' \(0x[A-Fa-f0-9]+\)>$")72
+ self.assertRegexpMatches(repr(c_wchar_p.from_param('hihi')), "^<cparam 'Z' \(0x[A-Fa-f0-9]+\)>$")73
+ self.assertRegexpMatches(repr(c_void_p.from_param(0x12)), r"^<cparam 'P' \(0x0*12\)>$")74
+75
################################################################76
77
if __name__ == '__main__':78
--- /dev/null79
+++ b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst80
81
+Avoid static buffers when computing the repr of :class:`ctypes.c_double` and82
+:class:`ctypes.c_longdouble` values.83
--- a/Modules/_ctypes/callproc.c84
+++ b/Modules/_ctypes/callproc.c85
86
static PyObject *87
PyCArg_repr(PyCArgObject *self)88
{89
- char buffer[256];90
switch(self->tag) {91
case 'b':92
case 'B':93
- sprintf(buffer, "<cparam '%c' (%d)>",94
+ return PyUnicode_FromFormat("<cparam '%c' (%d)>",95
self->tag, self->value.b);96
- break;97
case 'h':98
case 'H':99
- sprintf(buffer, "<cparam '%c' (%d)>",100
+ return PyUnicode_FromFormat("<cparam '%c' (%d)>",101
self->tag, self->value.h);102
- break;103
case 'i':104
case 'I':105
- sprintf(buffer, "<cparam '%c' (%d)>",106
+ return PyUnicode_FromFormat("<cparam '%c' (%d)>",107
self->tag, self->value.i);108
- break;109
case 'l':110
case 'L':111
- sprintf(buffer, "<cparam '%c' (%ld)>",112
+ return PyUnicode_FromFormat("<cparam '%c' (%ld)>",113
self->tag, self->value.l);114
- break;115
116
-#ifdef HAVE_LONG_LONG117
+#if defined(HAVE_LONG_LONG) && defined(LLONG_MAX)118
case 'q':119
case 'Q':120
- sprintf(buffer,121
- "<cparam '%c' (%" PY_FORMAT_LONG_LONG "d)>",122
+ return PyUnicode_FromFormat("<cparam '%c' (%lld)>",123
self->tag, self->value.q);124
- break;125
#endif126
case 'd':127
- sprintf(buffer, "<cparam '%c' (%f)>",128
- self->tag, self->value.d);129
- break;130
- case 'f':131
- sprintf(buffer, "<cparam '%c' (%f)>",132
- self->tag, self->value.f);133
- break;134
+ case 'f': {135
+ PyObject *f = PyFloat_FromDouble((self->tag == 'f') ? self->value.f : self->value.d);136
+ if (f == NULL) {137
+ return NULL;138
+ }139
+ PyObject *result = PyUnicode_FromFormat("<cparam '%c' (%R)>", self->tag, f);140
+ Py_DECREF(f);141
+ return result;142
+ }143
144
case 'c':145
- sprintf(buffer, "<cparam '%c' (%c)>",146
- self->tag, self->value.c);147
- break;148
+ return PyUnicode_FromFormat("<cparam '%c' ('%c')>",149
+ self->tag, self->value.c);150
151
/* Hm, are these 'z' and 'Z' codes useful at all?152
Shouldn't they be replaced by the functionality of c_string153
154
case 'z':155
case 'Z':156
case 'P':157
- sprintf(buffer, "<cparam '%c' (%p)>",158
+ return PyUnicode_FromFormat("<cparam '%c' (%p)>",159
self->tag, self->value.p);160
- break;161
162
default:163
- sprintf(buffer, "<cparam '%c' at %p>",164
- self->tag, self);165
- break;166
+ return PyUnicode_FromFormat("<cparam '%c' at %p>",167
+ (unsigned char)self->tag, (void *)self);168
}169
- return PyString_FromString(buffer);170
}171
172
static PyMemberDef PyCArgType_members[] = {173