Description

aisk

opened on Oct 12, 2026

Issue body actions

Bug report

Bug description:

In the _winapi.CreateProcess audit event, the second argument (command_line) is a Python object, but it is passed to PySys_Audit with the u format, so audit hooks may receive garbage instead of the command line.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

Linked PRs

• gh-159237: Fix buffer type confusion in _winapi.CreateProcess audit event #159238

Activity

1. aisk

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   OS-windows

   on Oct 12, 2026
2. kevinprimeraquecreo-stack

   added this to Project_VKon Oct 18, 2026
3. github-project-automation

   moved this to Todo in Project_VKon Oct 18, 2026
4. kevinprimeraquecreo-stack

   added this to Project_VKon Oct 18, 2026
5. sduchene-208 commented on Nov 1, 2026

   

   sduchene-208

   on Nov 1, 2026

   More actions

   Additional confirmation on CPython 3.13.15, Windows x64.

   The standalone script below ran twice using -I -B -S. Both runs observed one _winapi.CreateProcess audit event with three arguments of types str, str, NoneType. The executable and current directory matched, but the command was '\x03' rather than the supplied command; command equality and identity were false. Each run ended with the expected AssertionError.

   The hook raised its sentinel before native process creation. Each supervised job recorded one lifetime process (the diagnostic itself), zero remaining processes, and completed shutdown. The invalid environment is an additional fallback to reject the operation before native creation if the target audit event is absent. The particular garbage character is not assumed stable.

   The uuu → uOu correction in PR #159238 matches the source types. No patched interpreter was built or tested in these runs. This confirmation and script were prepared with AI assistance; the observations come from two separately supervised executions. No security severity or exploit impact is claimed.

   Executed standalone reproducer

   import sys
   
   if sys.platform != "win32":
       raise SystemExit("Windows only")
   
   import _winapi
   import subprocess
   
   class AuditStop(Exception):
       pass
   
   stop = AuditStop("stop before native process creation")
   ready = False
   observations = []
   
   def hook(event, args):
       global ready
       if event == "audit_probe.ready":
           ready = True
       elif event == "_winapi.CreateProcess":
           observations.append(args)
           raise stop
   
   sys.addaudithook(hook)
   sys.audit("audit_probe.ready")
   if not ready:
       raise RuntimeError("Audit hook registration was suppressed")
   
   command = subprocess.list2cmdline(
       [sys.executable, "-I", "-S", "-c", "pass"]
   )
   expected = (sys.executable, command, None)
   
   try:
       _winapi.CreateProcess(
           sys.executable, command, None, None, False, 0,
           object(),  # Invalid environment: fallback rejection before native creation.
           None, subprocess.STARTUPINFO()
       )
   except AuditStop as exc:
       assert exc is stop
   
   assert len(observations) == 1
   actual = observations[0]
   print("expected:", expected)
   print("actual:", actual)
   print("types:", tuple(type(value).__name__ for value in actual))
   assert len(actual) == 3
   assert actual == expected
   assert type(actual[0]) is str
   assert type(actual[1]) is str
   assert actual[2] is None
   assert actual[1] is command

Issue actions