Hi, I have a question about Issue 42938: [security] ctypes double representation BoF - Python tracker, which fixes security issues in Modules/_ctypes/callproc.c. I’m trying to get a handle on how central the affected functions are in the Python runtime. Are there particular cases that go through these functions and are therefore vulnerable prior to the fix? Or is it the case that these functions are very fundamental and could affect almost any uses of data in Python?
Thanks,
Grant
The problem only affects code that uses ctypes. Python’s core and standard library does not depend on ctypes. We use it in our integrated test suite. Multiprocessing has some code for shared ctypes objects, but doesn’t use it otherwise. You are not affected unless your code or one of your dependencies uses ctypes and your code allows a malicious users to pass arbitrary values to ctypes.
@ambv has published release candidates 3.9.2rc1 and Python 3.8.8rc1 yesterday. Final releases are schedueld for 2021-03-01.
https://mail.python.org/pipermail/python-list/2021-February/900966.html
That’s very helpful, thanks!