From b420601f0900282a8d6b901c4cf73b915a0fc794 Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Fri, 9 Sep 2016 11:56:34 -0700 Subject: Issue #24594: Validates persist parameter when opening MSI database --- PC/_msi.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) (limited to 'PC') diff --git a/PC/_msi.c b/PC/_msi.c index 574dddec05..d56b5d10dc 100644 --- a/PC/_msi.c +++ b/PC/_msi.c @@ -938,6 +938,17 @@ static PyTypeObject msidb_Type = { 0, /*tp_is_gc*/ }; +#define Py_NOT_PERSIST(x, flag) \ + (x != (int)(flag) && \ + x != ((int)(flag) | MSIDBOPEN_PATCHFILE)) + +#define Py_INVALID_PERSIST(x) \ + (Py_NOT_PERSIST(x, MSIDBOPEN_READONLY) && \ + Py_NOT_PERSIST(x, MSIDBOPEN_TRANSACT) && \ + Py_NOT_PERSIST(x, MSIDBOPEN_DIRECT) && \ + Py_NOT_PERSIST(x, MSIDBOPEN_CREATE) && \ + Py_NOT_PERSIST(x, MSIDBOPEN_CREATEDIRECT)) + static PyObject* msiopendb(PyObject *obj, PyObject *args) { int status; @@ -945,11 +956,14 @@ static PyObject* msiopendb(PyObject *obj, PyObject *args) int persist; MSIHANDLE h; msiobj *result; - if (!PyArg_ParseTuple(args, "si:MSIOpenDatabase", &path, &persist)) return NULL; - - status = MsiOpenDatabase(path, (LPCSTR)persist, &h); + /* We need to validate that persist is a valid MSIDBOPEN_* value. Otherwise, + MsiOpenDatabase may treat the value as a pointer, leading to unexpected + behavior. */ + if (Py_INVALID_PERSIST(persist)) + return msierror(ERROR_INVALID_PARAMETER); + status = MsiOpenDatabase(path, (LPCSTR)persist, &h); if (status != ERROR_SUCCESS) return msierror(status); -- cgit v1.2.1