summaryrefslogtreecommitdiff
path: root/gnu/packages
diff options
context:
space:
mode:
authorLeo Famulari <leo@famulari.name>2021-02-19 17:45:05 -0500
committerLeo Famulari <leo@famulari.name>2021-02-19 17:58:54 -0500
commitf08c7cb0c75e7d5305c82d6a4af68ddf74fb08b1 (patch)
tree90cf27aad1518f9241189e5fdcaddd7e993b3a49 /gnu/packages
parentf310b06685cb9b1f95150b24f3eed82ca280c1d2 (diff)
gnu: Python 3.9: Fix CVE-2021-3177.
* gnu/packages/patches/python-3.9-CVE-2021-3177.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/python.scm (python-3.9)[source]: Use it.
Diffstat (limited to 'gnu/packages')
-rw-r--r--gnu/packages/patches/python-3.9-CVE-2021-3177.patch194
-rw-r--r--gnu/packages/python.scm3
2 files changed, 196 insertions, 1 deletions
diff --git a/gnu/packages/patches/python-3.9-CVE-2021-3177.patch b/gnu/packages/patches/python-3.9-CVE-2021-3177.patch
new file mode 100644
index 00000000000..155f17deca0
--- /dev/null
+++ b/gnu/packages/patches/python-3.9-CVE-2021-3177.patch
@@ -0,0 +1,194 @@
1Fix CVE-2021-3177 for Python 3.9:
2
3https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3177
4
5Patch copied from upstream source repository:
6
7https://github.com/python/cpython/commit/c347cbe694743cee120457aa6626712f7799a932
8
9From c347cbe694743cee120457aa6626712f7799a932 Mon Sep 17 00:00:00 2001
10From: "Miss Islington (bot)"
11 <31488909+miss-islington@users.noreply.github.com>
12Date: Mon, 18 Jan 2021 13:29:31 -0800
13Subject: [PATCH] closes bpo-42938: Replace snprintf with Python unicode
14 formatting in ctypes param reprs. (GH-24247)
15
16(cherry picked from commit 916610ef90a0d0761f08747f7b0905541f0977c7)
17
18Co-authored-by: Benjamin Peterson <benjamin@python.org>
19
20Co-authored-by: Benjamin Peterson <benjamin@python.org>
21---
22 Lib/ctypes/test/test_parameters.py | 43 ++++++++++++++++
23 .../2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst | 2 +
24 Modules/_ctypes/callproc.c | 51 +++++++------------
25 3 files changed, 64 insertions(+), 32 deletions(-)
26 create mode 100644 Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
27
28diff --git a/Lib/ctypes/test/test_parameters.py b/Lib/ctypes/test/test_parameters.py
29index e4c25fd880cef..531894fdec838 100644
30--- a/Lib/ctypes/test/test_parameters.py
31+++ b/Lib/ctypes/test/test_parameters.py
32@@ -201,6 +201,49 @@ def __dict__(self):
33 with self.assertRaises(ZeroDivisionError):
34 WorseStruct().__setstate__({}, b'foo')
35
36+ def test_parameter_repr(self):
37+ from ctypes import (
38+ c_bool,
39+ c_char,
40+ c_wchar,
41+ c_byte,
42+ c_ubyte,
43+ c_short,
44+ c_ushort,
45+ c_int,
46+ c_uint,
47+ c_long,
48+ c_ulong,
49+ c_longlong,
50+ c_ulonglong,
51+ c_float,
52+ c_double,
53+ c_longdouble,
54+ c_char_p,
55+ c_wchar_p,
56+ c_void_p,
57+ )
58+ self.assertRegex(repr(c_bool.from_param(True)), r"^<cparam '\?' at 0x[A-Fa-f0-9]+>$")
59+ self.assertEqual(repr(c_char.from_param(97)), "<cparam 'c' ('a')>")
60+ self.assertRegex(repr(c_wchar.from_param('a')), r"^<cparam 'u' at 0x[A-Fa-f0-9]+>$")
61+ self.assertEqual(repr(c_byte.from_param(98)), "<cparam 'b' (98)>")
62+ self.assertEqual(repr(c_ubyte.from_param(98)), "<cparam 'B' (98)>")
63+ self.assertEqual(repr(c_short.from_param(511)), "<cparam 'h' (511)>")
64+ self.assertEqual(repr(c_ushort.from_param(511)), "<cparam 'H' (511)>")
65+ self.assertRegex(repr(c_int.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
66+ self.assertRegex(repr(c_uint.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
67+ self.assertRegex(repr(c_long.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
68+ self.assertRegex(repr(c_ulong.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
69+ self.assertRegex(repr(c_longlong.from_param(20000)), r"^<cparam '[liq]' \(20000\)>$")
70+ self.assertRegex(repr(c_ulonglong.from_param(20000)), r"^<cparam '[LIQ]' \(20000\)>$")
71+ self.assertEqual(repr(c_float.from_param(1.5)), "<cparam 'f' (1.5)>")
72+ self.assertEqual(repr(c_double.from_param(1.5)), "<cparam 'd' (1.5)>")
73+ self.assertEqual(repr(c_double.from_param(1e300)), "<cparam 'd' (1e+300)>")
74+ self.assertRegex(repr(c_longdouble.from_param(1.5)), r"^<cparam ('d' \(1.5\)|'g' at 0x[A-Fa-f0-9]+)>$")
75+ self.assertRegex(repr(c_char_p.from_param(b'hihi')), "^<cparam 'z' \(0x[A-Fa-f0-9]+\)>$")
76+ self.assertRegex(repr(c_wchar_p.from_param('hihi')), "^<cparam 'Z' \(0x[A-Fa-f0-9]+\)>$")
77+ self.assertRegex(repr(c_void_p.from_param(0x12)), r"^<cparam 'P' \(0x0*12\)>$")
78+
79 ################################################################
80
81 if __name__ == '__main__':
82diff --git a/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
83new file mode 100644
84index 0000000000000..7df65a156feab
85--- /dev/null
86+++ b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
87@@ -0,0 +1,2 @@
88+Avoid static buffers when computing the repr of :class:`ctypes.c_double` and
89+:class:`ctypes.c_longdouble` values.
90diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
91index b0a36a30248f7..f2506de54498e 100644
92--- a/Modules/_ctypes/callproc.c
93+++ b/Modules/_ctypes/callproc.c
94@@ -489,58 +489,47 @@ is_literal_char(unsigned char c)
95 static PyObject *
96 PyCArg_repr(PyCArgObject *self)
97 {
98- char buffer[256];
99 switch(self->tag) {
100 case 'b':
101 case 'B':
102- sprintf(buffer, "<cparam '%c' (%d)>",
103+ return PyUnicode_FromFormat("<cparam '%c' (%d)>",
104 self->tag, self->value.b);
105- break;
106 case 'h':
107 case 'H':
108- sprintf(buffer, "<cparam '%c' (%d)>",
109+ return PyUnicode_FromFormat("<cparam '%c' (%d)>",
110 self->tag, self->value.h);
111- break;
112 case 'i':
113 case 'I':
114- sprintf(buffer, "<cparam '%c' (%d)>",
115+ return PyUnicode_FromFormat("<cparam '%c' (%d)>",
116 self->tag, self->value.i);
117- break;
118 case 'l':
119 case 'L':
120- sprintf(buffer, "<cparam '%c' (%ld)>",
121+ return PyUnicode_FromFormat("<cparam '%c' (%ld)>",
122 self->tag, self->value.l);
123- break;
124
125 case 'q':
126 case 'Q':
127- sprintf(buffer,
128-#ifdef MS_WIN32
129- "<cparam '%c' (%I64d)>",
130-#else
131- "<cparam '%c' (%lld)>",
132-#endif
133+ return PyUnicode_FromFormat("<cparam '%c' (%lld)>",
134 self->tag, self->value.q);
135- break;
136 case 'd':
137- sprintf(buffer, "<cparam '%c' (%f)>",
138- self->tag, self->value.d);
139- break;
140- case 'f':
141- sprintf(buffer, "<cparam '%c' (%f)>",
142- self->tag, self->value.f);
143- break;
144-
145+ case 'f': {
146+ PyObject *f = PyFloat_FromDouble((self->tag == 'f') ? self->value.f : self->value.d);
147+ if (f == NULL) {
148+ return NULL;
149+ }
150+ PyObject *result = PyUnicode_FromFormat("<cparam '%c' (%R)>", self->tag, f);
151+ Py_DECREF(f);
152+ return result;
153+ }
154 case 'c':
155 if (is_literal_char((unsigned char)self->value.c)) {
156- sprintf(buffer, "<cparam '%c' ('%c')>",
157+ return PyUnicode_FromFormat("<cparam '%c' ('%c')>",
158 self->tag, self->value.c);
159 }
160 else {
161- sprintf(buffer, "<cparam '%c' ('\\x%02x')>",
162+ return PyUnicode_FromFormat("<cparam '%c' ('\\x%02x')>",
163 self->tag, (unsigned char)self->value.c);
164 }
165- break;
166
167 /* Hm, are these 'z' and 'Z' codes useful at all?
168 Shouldn't they be replaced by the functionality of c_string
169@@ -549,22 +538,20 @@ PyCArg_repr(PyCArgObject *self)
170 case 'z':
171 case 'Z':
172 case 'P':
173- sprintf(buffer, "<cparam '%c' (%p)>",
174+ return PyUnicode_FromFormat("<cparam '%c' (%p)>",
175 self->tag, self->value.p);
176 break;
177
178 default:
179 if (is_literal_char((unsigned char)self->tag)) {
180- sprintf(buffer, "<cparam '%c' at %p>",
181+ return PyUnicode_FromFormat("<cparam '%c' at %p>",
182 (unsigned char)self->tag, (void *)self);
183 }
184 else {
185- sprintf(buffer, "<cparam 0x%02x at %p>",
186+ return PyUnicode_FromFormat("<cparam 0x%02x at %p>",
187 (unsigned char)self->tag, (void *)self);
188 }
189- break;
190 }
191- return PyUnicode_FromString(buffer);
192 }
193
194 static PyMemberDef PyCArgType_members[] = {
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index 27e9b70432b..730c371fdac 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -11,7 +11,7 @@
11;;; Copyright © 2015, 2016 Christopher Allan Webber <cwebber@dustycloud.org> 11;;; Copyright © 2015, 2016 Christopher Allan Webber <cwebber@dustycloud.org>
12;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr> 12;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
13;;; Copyright © 2015, 2016 David Thompson <davet@gnu.org> 13;;; Copyright © 2015, 2016 David Thompson <davet@gnu.org>
14;;; Copyright © 2015, 2016, 2017 Leo Famulari <leo@famulari.name> 14;;; Copyright © 2015, 2016, 2017, 2021 Leo Famulari <leo@famulari.name>
15;;; Copyright © 2015, 2017 Ben Woodcroft <donttrustben@gmail.com> 15;;; Copyright © 2015, 2017 Ben Woodcroft <donttrustben@gmail.com>
16;;; Copyright © 2015, 2016 Erik Edrosa <erik.edrosa@gmail.com> 16;;; Copyright © 2015, 2016 Erik Edrosa <erik.edrosa@gmail.com>
17;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Efraim Flashner <efraim@flashner.co.il> 17;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Efraim Flashner <efraim@flashner.co.il>
@@ -531,6 +531,7 @@ data types.")
531 version "/Python-" version ".tar.xz")) 531 version "/Python-" version ".tar.xz"))
532 (patches (search-patches 532 (patches (search-patches
533 "python-3.9-fix-tests.patch" 533 "python-3.9-fix-tests.patch"
534 "python-3.9-CVE-2021-3177.patch"
534 "python-3-deterministic-build-info.patch" 535 "python-3-deterministic-build-info.patch"
535 "python-3-search-paths.patch")) 536 "python-3-search-paths.patch"))
536 (sha256 537 (sha256
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-03 09:38:16 +0000