From 6ceda631af2717c271e0b5b2b05a036463764418 Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Fri, 9 Sep 2016 11:56:34 -0700 Subject: [PATCH] Issue #24594: Validates persist parameter when opening MSI database --- Misc/NEWS | 2 ++ PC/_msi.c | 20 +++++++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS index 86d499b29f4..e4061d64d43 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -62,6 +62,8 @@ Core and Builtins Library ------- +- Issue #24594: Validates persist parameter when opening MSI database + - Issue #28047: Fixed calculation of line length used for the base64 CTE in the new email policies. diff --git a/PC/_msi.c b/PC/_msi.c index 86a59431064..9e7e36da716 100644 --- a/PC/_msi.c +++ b/PC/_msi.c @@ -955,6 +955,17 @@ static PyTypeObject msidb_Type = { 0, /*tp_is_gc*/ }; +#define Py_NOT_PERSIST(x, flag) \ + (x != (int)(flag) && \ + x != ((int)(flag) | MSIDBOPEN_PATCHFILE)) + +#define Py_INVALID_PERSIST(x) \ + (Py_NOT_PERSIST(x, MSIDBOPEN_READONLY) && \ + Py_NOT_PERSIST(x, MSIDBOPEN_TRANSACT) && \ + Py_NOT_PERSIST(x, MSIDBOPEN_DIRECT) && \ + Py_NOT_PERSIST(x, MSIDBOPEN_CREATE) && \ + Py_NOT_PERSIST(x, MSIDBOPEN_CREATEDIRECT)) + static PyObject* msiopendb(PyObject *obj, PyObject *args) { int status; @@ -962,11 +973,14 @@ static PyObject* msiopendb(PyObject *obj, PyObject *args) int persist; MSIHANDLE h; msiobj *result; - if (!PyArg_ParseTuple(args, "si:MSIOpenDatabase", &path, &persist)) return NULL; - - status = MsiOpenDatabase(path, (LPCSTR)persist, &h); + /* We need to validate that persist is a valid MSIDBOPEN_* value. Otherwise, + MsiOpenDatabase may treat the value as a pointer, leading to unexpected + behavior. */ + if (Py_INVALID_PERSIST(persist)) + return msierror(ERROR_INVALID_PARAMETER); + status = MsiOpenDatabase(path, (LPCSTR)persist, &h); if (status != ERROR_SUCCESS) return msierror(status);