Skip to content

Commit d7c445d

Browse files
ever0demiss-islington
authored andcommitted
gh-150913: Fix sqlite3.Blob validation for empty slice assignment (GH-150915)
ass_subscript_slice() returned early when the computed slice length was zero, bypassing validation performed for non-empty slices. (cherry picked from commit fc9c4db) Co-authored-by: Jiseok CHOI <jiseok.dev@gmail.com>
1 parent d7beb9c commit d7c445d

3 files changed

Lines changed: 25 additions & 6 deletions

File tree

Lib/test/test_sqlite3/test_dbapi.py

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1431,6 +1431,18 @@ def test_blob_set_empty_slice(self):
14311431
self.blob[0:0] = b""
14321432
self.assertEqual(self.blob[:], self.data)
14331433

1434+
def test_blob_set_empty_slice_wrong_type(self):
1435+
with self.assertRaises(TypeError):
1436+
self.blob[5:5] = None
1437+
1438+
def test_blob_set_empty_slice_wrong_size(self):
1439+
with self.assertRaisesRegex(IndexError, "wrong size"):
1440+
self.blob[5:5] = b"123"
1441+
1442+
def test_blob_set_empty_slice_correct(self):
1443+
self.blob[5:5] = b""
1444+
self.assertEqual(self.blob[:], self.data)
1445+
14341446
def test_blob_set_slice_with_skip(self):
14351447
self.blob[0:10:2] = b"12345"
14361448
actual = self.cx.execute("select b from test").fetchone()[0]
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Fix :class:`sqlite3.Blob` slice assignment to raise
2+
:exc:`TypeError` and :exc:`IndexError` for type and size mismatches
3+
respectively, even when the target slice is empty.

Modules/_sqlite/blob.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -517,21 +517,25 @@ ass_subscript_slice(pysqlite_Blob *self, PyObject *item, PyObject *value)
517517
return -1;
518518
}
519519

520-
if (len == 0) {
521-
return 0;
522-
}
523-
524520
Py_buffer vbuf;
525521
if (PyObject_GetBuffer(value, &vbuf, PyBUF_SIMPLE) < 0) {
526522
return -1;
527523
}
528524

529-
int rc = -1;
530525
if (vbuf.len != len) {
531526
PyErr_SetString(PyExc_IndexError,
532527
"Blob slice assignment is wrong size");
528+
PyBuffer_Release(&vbuf);
529+
return -1;
533530
}
534-
else if (step == 1) {
531+
532+
if (len == 0) {
533+
PyBuffer_Release(&vbuf);
534+
return 0;
535+
}
536+
537+
int rc = -1;
538+
if (step == 1) {
535539
rc = inner_write(self, vbuf.buf, len, start);
536540
}
537541
else {

0 commit comments

Comments
 (0)