ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ ืคึผื™ื˜ื”ืึธืŸ ื•ื•ืขืŸ ื”ืึทื ื“ืœื™ื ื’ ืึทื ื•ื•ืึทืœืึทื“ื™ื™ื˜ื™ื“ ืคืจืึทืงืฉืึทื ืึทืœ ื ื•ืžืขืจืŸ ืื™ืŸ ืงื˜ื™ืคึผืขืก

ืงืึธืจืจืขืงื˜ื™ื•ื• ืจื™ืœื™ืกื™ื– ืคื•ืŸ ื“ื™ Python ืคึผืจืึธื’ืจืึทืžืžื™ื ื’ ืฉืคึผืจืึทืš 3.7.10 ืื•ืŸ 3.6.13 ื–ืขื ืขืŸ ื‘ืืจืขื›ื˜ื™ื’ื˜, ื•ื•ืึธืก ืคืึทืจืจื™ื›ื˜ืŸ ืึท ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ (CVE-2021-3177) ื•ื•ืึธืก ืงืขืŸ ืคื™ืจืŸ ืฆื• ืงืึธื“ ื“ื•ืจื›ืคื™ืจื•ื ื’ ื•ื•ืขืŸ ืคึผืจืึทืกืขืกื™ื ื’ ืึทื ื•ื•ืึทืœืึทื“ื™ื™ื˜ื™ื“ ืคืœืึธื•ื˜ื™ื ื’ ืคื•ื ื˜ ื ื•ืžืขืจืŸ ืื™ืŸ ื”ืึทื ื“ืœืขืจืก ื•ื•ืึธืก ืจื•ืคืŸ C ืคืึทื ื’ืงืฉืึทื ื– ื ื™ืฆืŸ ื“ื™ ctypes ืžืขืงืึทื ื™ื–ืึทื. . ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืื•ื™ืš ืึทืคืขืงืฅ ื“ื™ Python 3.8 ืื•ืŸ 3.9 ืฆื•ื•ื™ื™ื’ืŸ, ืึธื‘ืขืจ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ืคึฟืึทืจ ื–ื™ื™ ื–ืขื ืขืŸ ื ืึธืš ืื™ืŸ ืžืขืœื“ื•ื ื’ ืงืึทื ื“ื™ื“ืึทื˜ ืกื˜ืึทื˜ื•ืก (ืžืขืœื“ื•ื ื’ ืกืงืขื“ื–ืฉื•ืœื“ ืคึฟืึทืจ 1 ืžืขืจ).

ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืื™ื– ื’ืขืคึฟื™ืจื˜ ื“ื•ืจืš ืึท ื‘ืึทืคืขืจ ืึธื•ื•ื•ืขืจืคืœืึธื• ืื™ืŸ ื“ื™ ctypes ืคื•ื ืงืฆื™ืข PyCARg_repr (), ื•ื•ืึธืก ืึทืงืขืจื– ืจืขื›ื˜ ืฆื• ืึทื ืกื™ื™ืฃ ื ื•ืฆืŸ ืคื•ืŸ ืกืคึผืจื™ื ื˜ืฃ. ืื™ืŸ ื‘ืึทื–ื•ื ื“ืขืจ, ืึท ืกื˜ืึทื˜ื™ืง ื‘ืึทืคืขืจ ืคื•ืŸ 256 ื‘ื™ื˜ืขืก ืื™ืŸ ื’ืจื™ื™ืก ("ื˜ืฉืึทืจ ื‘ืึทืคืขืจ" [256]"), ื‘ืฉืขืช ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜ ืงืขืŸ ื™ืงืกื™ื“ ื“ืขื ื•ื•ืขืจื˜. ืฆื• ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืคื•ืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ืฆื• ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™, ืื™ืจ ืงืขื ืขืŸ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ืคืึธืจืŸ ื“ื™ ื•ื•ืขืจื˜ "1e300", ื•ื•ืึธืก, ื•ื•ืขืŸ ืคึผืจืึทืกืขืกื˜ ื“ื•ืจืš ื“ื™ c_double.from_param ืื•ืคึฟืŸ, ื•ื•ืขื˜ ืคื™ืจืŸ ืฆื• ืึท ืงืจืึทืš, ื•ื•ื™ื™ึทืœ ื“ื™ ืจื™ื–ืึทืœื˜ื™ื ื’ ื ื•ืžืขืจ ื›ึผื•ืœืœ 308 ืื•ืชื™ื•ืช ืื•ืŸ ืื™ื– ื ื™ืฉื˜ ืคึผืึทืกื™ืง ืื™ืŸ ืึท 256-ื‘ื™ื˜ืข ื‘ืึทืคืขืจ. ื‘ื™ื™ึทืฉืคึผื™ืœ ืคื•ืŸ ืคึผืจืึธื‘ืœืขืžืึทื˜ื™ืง ืงืึธื“: ืึทืจื™ื™ึทื ืคื™ืจ ืงื˜ื™ืคึผืขืก; ืจืขื ื˜ื’ืขื  = ctypes.c_double.from_param(1e300); ืจืขืคึผืจ (ืงืกื ื•ืžืงืก)

ื“ืขืจ ืคึผืจืึธื‘ืœืขื ื‘ืœื™ื™ื‘ื˜ ืึทื ืคื™ืงืกื˜ ืื™ืŸ Debian, Ubuntu ืื•ืŸ FreeBSD, ืึธื‘ืขืจ ืื™ื– ืฉื•ื™ืŸ ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ Arch Linux, Fedora, SUSE. ืื™ืŸ RHEL, ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืงืขืŸ ื ื™ืฉื˜ ืคึผืึทืกื™ืจืŸ ืจืขื›ื˜ ืฆื• ืคึผืขืงืœ ืคึฟืึทืจื–ืึทืžืœื•ื ื’ ืื™ืŸ FORTIFY_SOURCE ืžืึธื“ืข, ื•ื•ืึธืก ื‘ืœืึทืงืก ืึทื–ืึท ื‘ืึทืคืขืจ ืึธื•ื•ื•ืขืจืคืœืึธื•ื– ืื™ืŸ ืฉื˜ืจื™ืงืœ ืคืึทื ื’ืงืฉืึทื ื–.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’