Hi, 

There's a buffer overflow in the PyCArg_repr() function in _ctypes/callproc.c.

The buffer overflow happens due to not checking the length of th sprintf() function on line: 

    case 'd':
        sprintf(buffer, "<cparam '%c' (%f)>",
            self->tag, self->value.d);
        break;

Because we control self->value.d we could make it copy _extreme_ values. For example we could make it copy 1e300 which would be a 1 with 300 zero's  to overflow the buffer.

This could potentially cause RCE when a user allows untrusted input in these functions.

A minimal PoC:

>>> from ctypes import *
>>> c_double.from_param(1e300)
*** buffer overflow detected ***: terminated
Aborted


I recommend __always__ controlling how much you copy so I'd use snprintf with a size argument instead.

Best Regards,

Jordy Zomer

New changeset 916610ef90a0d0761f08747f7b0905541f0977c7 by Benjamin Peterson in branch 'master':
closes bpo-42938: Replace snprintf with Python unicode formatting in ctypes param reprs. (24239)
https://github.com/python/cpython/commit/916610ef90a0d0761f08747f7b0905541f0977c7

New changeset 34df10a9a16b38d54421eeeaf73ec89828563be7 by Benjamin Peterson in branch '3.6':
[3.6] closes bpo-42938: Replace snprintf with Python unicode formatting in ctypes param reprs. (GH-24250)
https://github.com/python/cpython/commit/34df10a9a16b38d54421eeeaf73ec89828563be7

New changeset d9b8f138b7df3b455b54653ca59f491b4840d6fa by Benjamin Peterson in branch '3.7':
[3.7] closes bpo-42938: Replace snprintf with Python unicode formatting in ctypes param reprs. (GH-24249)
https://github.com/python/cpython/commit/d9b8f138b7df3b455b54653ca59f491b4840d6fa

New changeset ece5dfd403dac211f8d3c72701fe7ba7b7aa5b5f by Miss Islington (bot) in branch '3.8':
closes bpo-42938: Replace snprintf with Python unicode formatting in ctypes param reprs. (GH-24248)
https://github.com/python/cpython/commit/ece5dfd403dac211f8d3c72701fe7ba7b7aa5b5f

New changeset c347cbe694743cee120457aa6626712f7799a932 by Miss Islington (bot) in branch '3.9':
closes bpo-42938: Replace snprintf with Python unicode formatting in ctypes param reprs. (GH-24247)
https://github.com/python/cpython/commit/c347cbe694743cee120457aa6626712f7799a932

FYI I created https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html to track fixes of this issue.

CVE-2021-3177 has been assigned to this issue:
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3177
* https://access.redhat.com/security/cve/cve-2021-3177

Petition to remove all uses of the unchecked string handling functions from CPython?

Sidenote: if C4996 was on, this would be a warning.

Alexander, this bug report is closed. Could you please open a new request and explain your proposal?

Yes, I definitely should. I work on https://bugs.python.org/issue25878 sometimes, which encompasses this.