GH-115322: fix ctypes call_function audit hook on 32-bit platforms (GH-132496)

* GH-115322: fix ctypes call_function audit hook on 32-bit platforms.

It was using a signed conversion to communicate the function id (pointer) value.

diff --git a/Lib/test/audit-tests.py b/Lib/test/audit-tests.py
index 3d81f27e5cb46d79819bbc0b7b1c72801a6509fa..08b638e4b8d524579d45d576e4fff3739686d2bf 100644 (file)
--- a/Lib/test/audit-tests.py
+++ b/Lib/test/audit-tests.py
@@ -311,10 +311,10 @@ def test_ctypes_call_function():
 
     with TestHook() as hook:
         _ctypes.call_function(ctypes._memmove_addr, (0, 0, 0))
-        assert ("ctypes.call_function", (ctypes._memmove_addr, (0, 0, 0))) in hook.seen
+        assert ("ctypes.call_function", (ctypes._memmove_addr, (0, 0, 0))) in hook.seen, f"{ctypes._memmove_addr=} {hook.seen=}"
 
         ctypes.CFUNCTYPE(ctypes.c_voidp)(ctypes._memset_addr)(1, 0, 0)
-        assert ("ctypes.call_function", (ctypes._memset_addr, (1, 0, 0))) in hook.seen
+        assert ("ctypes.call_function", (ctypes._memset_addr, (1, 0, 0))) in hook.seen, f"{ctypes._memset_addr=} {hook.seen=}"
 
     with TestHook() as hook:
         ctypes.cast(ctypes.c_voidp(0), ctypes.POINTER(ctypes.c_char))

diff --git a/Misc/NEWS.d/next/Security/2024-02-18-02-53-25.gh-issue-115322.Um2Sjx.rst b/Misc/NEWS.d/next/Security/2024-02-18-02-53-25.gh-issue-115322.Um2Sjx.rst
index a09e1f1fcdcab78135d29f5bf39816969d063e54..8eb5c3ed04ee2c6451a08a097fa8138746bff6d4 100644 (file)
--- a/Misc/NEWS.d/next/Security/2024-02-18-02-53-25.gh-issue-115322.Um2Sjx.rst
+++ b/Misc/NEWS.d/next/Security/2024-02-18-02-53-25.gh-issue-115322.Um2Sjx.rst
@@ -1,4 +1,5 @@
 The underlying extension modules behind :mod:`readline`:, :mod:`subprocess`,
 and :mod:`ctypes` now raise audit events on previously uncovered code paths
 that could lead to file system access related to C function calling and
-external binary execution.
+external binary execution.  The ``ctypes.call_function`` audit hook has also
+been fixed to use an unsigned value for its ``function pointer``.

diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
index f5db49ff4bc61cedc477f2abfb4f8eae5f1db86c..cb8ab7b33a29532378aebab7313af07fe37522b9 100644 (file)
--- a/Modules/_ctypes/callproc.c
+++ b/Modules/_ctypes/callproc.c
@@ -1199,8 +1199,17 @@ PyObject *_ctypes_callproc(ctypes_state *st,
     PyObject *retval = NULL;
 
     // Both call_function and call_cdeclfunction call us:
+#if SIZEOF_VOID_P == SIZEOF_LONG
+    if (PySys_Audit("ctypes.call_function", "kO",
+                    (unsigned long)pProc, argtuple) < 0) {
+#elif SIZEOF_VOID_P == SIZEOF_LONG_LONG
+    if (PySys_Audit("ctypes.call_function", "KO",
+                    (unsigned long long)pProc, argtuple) < 0) {
+#else
+# warning "unexpected pointer size, you may see odd values in audit hooks"
     if (PySys_Audit("ctypes.call_function", "nO",
                     (Py_ssize_t)pProc, argtuple) < 0) {
+#endif
         return NULL;
     }