[issue39401] [CVE-2020-8315] Unsafe dll loading in getpathp.c on Win7

2020-01-30 Thread Anthony Wee
Anthony Wee added the comment: > Thanks Anthony for the report! I included your name as the reporter, though I > don't see it on any of the pages. No problem! Thanks Steve, Eryk, and Victor for jumping on this! -- ___ Python tracker

[issue39401] Unsafe dll loading in getpathp.c on Win7

2020-01-20 Thread Anthony Wee
New submission from Anthony Wee : On Win7, running Python in the terminal will attempt to load the "api-ms-win-core-path-l1-1-0.dll" from various paths outside of the Python directory and the C:\Windows\System32 directories. This behavior can be verified using Process Monitor (see

[issue29778] _Py_CheckPython3 uses uninitialized dllpath when embedder sets module path with Py_SetPath

2020-01-07 Thread Anthony Wee
Anthony Wee added the comment: Hm, I'm seeing _Py_CheckPython3() use Py_GetPrefix(), which uses _Py_path_config.prefix? https://github.com/python/cpython/blob/c02b41b1fb115c87693530ea6a480b2e15460424/PC/getpathp.c#L1185 -- ___ Python tracker

[issue29778] _Py_CheckPython3 uses uninitialized dllpath when embedder sets module path with Py_SetPath

2020-01-07 Thread Anthony Wee
Anthony Wee added the comment: Thank you Steve! I'm still seeing python3.dll being loaded from \DLLs\python3.dll. _Py_CheckPython3() uses Py_GetPrefix() as a prefix for \DLLs\python3.dll. It looks like Py_SetPath() sets the _Py_path_config.prefix to "", but I'm not seeing anythin

[issue29778] _Py_CheckPython3 uses uninitialized dllpath when embedder sets module path with Py_SetPath

2020-01-03 Thread Anthony Wee
Change by Anthony Wee : -- pull_requests: +17244 pull_request: https://github.com/python/cpython/pull/17818 ___ Python tracker <https://bugs.python.org/issue29

[issue29778] _Py_CheckPython3 uses uninitialized dllpath when embedder sets module path with Py_SetPath

2019-12-31 Thread Anthony Wee
Anthony Wee added the comment: It looks like there has been a regression in the fix for this issue. The commit below introduced a NULL check which causes a call to _PyPathConfig_Init() to be skipped if _Py_dll_path == NULL. It seems like the check should be "if (_Py_dll_path !=