Skip to content

Gh-142174: Explicitly disallow _as_parameter_ returning tuples#142175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
CodeMaverick-143 wants to merge 10 commits into from
Closed

Gh-142174: Explicitly disallow _as_parameter_ returning tuples #142175

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
62d370f
fix: Explicitly disallow `_as_parameter_` returning tuples for defaul…
CodeMaverick-143 Dec 2, 2025
3fa9526
📜🤖 Added by blurb_it.
blurb-it[bot] Dec 2, 2025
6e36753
feat: Disallow tuple/list parameters in `_ctypes` and add null checks…
CodeMaverick-143 Dec 2, 2025
5c2c893
fix: Add RTLD_GLOBAL flag to dlopen for libSystem.B.dylib.
CodeMaverick-143 Dec 2, 2025
667e0f0
fix test
CodeMaverick-143 Dec 2, 2025
b41f966
Misc/NEWS.d: fix news fragment filename so blurb can parse (gh.issue-…
CodeMaverick-143 Dec 2, 2025
ef2bdd1
Misc/NEWS.d: rename news fragment to match blurb requirements (gh-iss…
CodeMaverick-143 Dec 2, 2025
2166010
fix Docs
CodeMaverick-143 Dec 2, 2025
7d801d5
Fix NEWS fragment: fully qualify ctypes.ArgumentError for Sphinx
CodeMaverick-143 Dec 2, 2025
ff176f1
Merge branch 'main' into main
CodeMaverick-143 Dec 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions Lib/test/test_ctypes/test_parameters.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -297,6 +297,20 @@ def from_param(cls, value):

self.assertEqual(trace, [1, 2, 3, 4, 5])

def test_as_parameter_tuple(self):
class Dangerous(object):
@property
def _as_parameter_(self):
return ('i', 42)

func = CDLL(_ctypes_test.__file__)._testfunc_p_p
func.restype = c_int
# func.argtypes = [c_void_p] # Do not set argtypes to force default conversion

# Should raise ArgumentError because tuples are not supported in default conversion
with self.assertRaisesRegex(ArgumentError, "argument 1: TypeError: Don't know how to convert parameter 1"):
func(Dangerous(), 0)

Comment on lines +300 to +313
Copy link
Member

@ZeroIntensityZeroIntensityDec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test already passes on main.


if __name__ == '__main__':
unittest.main()
Empty file addedMisc/NEWS.d/next/Tests/2025-12-02-06-38-27.gh-issue-142174.jRSTqe.rst
View file
Open in desktop
Empty file.
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Tests/2025-12-02-12-15-00.gh-issue-142174.codemaverick.rst
View file
Open in desktop
Copy link
Member

@ZeroIntensityZeroIntensityDec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please don't put your name in the filename. If you'd like to get credit, you can add something like "Patch by Your Name." at the end of the entry.

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@

Copy link
Member

@ZeroIntensityZeroIntensityDec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extra newline.

Analysis confirms that :mod:`ctypes` does not support returning tuples from ``_as_parameter_`` for default conversions. Attempting to do so raises a :exc:`TypeError` (wrapped in a ``ctypes.ArgumentError``), meaning the described security risk does not exist in the current codebase.
Copy link
Member

@picnixzpicnixzDec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This NEWS entry is too verbose and if returning tuples from _as_parameter_ wasn't already supported and the change is only a redundant comment removal, then no NEWS is needed.

12 changes: 8 additions & 4 deletions Modules/_ctypes/callproc.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -620,9 +620,6 @@ PyType_Spec carg_spec ={
* by value, or a 2-tuple or 3-tuple which will be used according
* to point 2 above. The third item (if any), is ignored. It is normally
* used to keep the object alive where this parameter refers to.
* XXX This convention is dangerous - you can construct arbitrary tuples
* in Python and pass them. Would it be safer to use a custom container
* datatype instead of a tuple?
*
* 4. Other Python objects cannot be passed as parameters - an exception is raised.
*
Expand DownExpand Up@@ -742,6 +739,13 @@ static int ConvParam(ctypes_state *st,
attribute)
*/
if (arg){
if (PyTuple_Check(arg) || PyList_Check(arg)){
Py_DECREF(arg);
PyErr_Format(PyExc_TypeError,
"Don't know how to convert parameter %d",
Py_SAFE_DOWNCAST(index, Py_ssize_t, int));
return -1;
}
int result;
Comment on lines +742 to 749
Copy link
Member

@picnixzpicnixzDec 3, 2025•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not a good check IMO. This shouldn't be checked at this level, it should ConvParam that should be responsible (and the recursive call should be enough). I don't unedrstand why we have this additional check here.

result = ConvParam(st, arg, index, pa);
Py_DECREF(arg);
Expand DownExpand Up@@ -1512,7 +1516,7 @@ static void *libsystem_b_handle;
static bool (*_dyld_shared_cache_contains_path)(const char *path);

__attribute__((constructor)) void load_dyld_shared_cache_contains_path(void){
libsystem_b_handle = dlopen("/usr/lib/libSystem.B.dylib", RTLD_LAZY);
libsystem_b_handle = dlopen("/usr/lib/libSystem.B.dylib", RTLD_LAZY | RTLD_GLOBAL);
Copy link
Member

@ZeroIntensityZeroIntensityDec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, this looks unrelated as well.

if (libsystem_b_handle != NULL){
_dyld_shared_cache_contains_path = dlsym(libsystem_b_handle, "_dyld_shared_cache_contains_path");
}
Expand Down
4 changes: 3 additions & 1 deletion Objects/object.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -91,7 +91,9 @@ reftotal_add(PyThreadState *tstate, Py_ssize_t n)
Py_ssize_t reftotal = tstate_impl->reftotal + n;
_Py_atomic_store_ssize_relaxed(&tstate_impl->reftotal, reftotal);
#else
REFTOTAL(tstate->interp) += n;
if (tstate && tstate->interp){
REFTOTAL(tstate->interp) += n;
}
Comment on lines +94 to +96
Copy link
Member

@ZeroIntensityZeroIntensityDec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks unrelated to this change and is incorrect. tstate and tstate->interp are never NULL here.

#endif
}

Expand Down
Loading