gh-150449: Fix sqlite3.Blob crash with negative-step slices

Reading or writing a sqlite3.Blob with a negative-step slice such as
blob[9:0:-2] caused a crash (SystemError on older versions, ValueError
on current main) because the C code computed stop - start as the read
length, which is negative for negative steps.

Fix subscript_slice() and ass_subscript_slice() in Modules/_sqlite/blob.c
to handle both positive and negative steps correctly:
- For step > 1: keep reading [start, stop) and indexing forward as before.
- For step < -1: read the contiguous range [start+(len-1)*step, start]
  and index backward with stride -step.

Author: ever0de

Lib/test/test_sqlite3/test_dbapi.py

@@ -1390,6 +1390,12 @@ def test_blob_get_slice_negative_index(self):
     def test_blob_get_slice_with_skip(self):
         self.assertEqual(self.blob[0:10:2], b"ti lb")
 
+    def test_blob_get_slice_with_negative_step(self):
+        # gh-150449: negative-step slices must not crash
+        self.assertEqual(self.blob[9:0:-2], self.data[9:0:-2])
+        self.assertEqual(self.blob[9::-2], self.data[9::-2])
+        self.assertEqual(self.blob[::-1], self.data[::-1])
+
     def test_blob_set_slice(self):
         self.blob[0:5] = b"12345"
         expected = b"12345" + self.data[5:]
@@ -1406,6 +1412,21 @@ def test_blob_set_slice_with_skip(self):
         expected = b"1h2s3b4o5 " + self.data[10:]
         self.assertEqual(actual, expected)
 
+    def test_blob_set_slice_with_negative_step(self):
+        # gh-150449: negative-step slice assignment must not crash
+        expected = bytearray(self.data)
+        expected[9:0:-2] = b"12345"
+        self.blob[9:0:-2] = b"12345"
+        actual = self.cx.execute("select b from test").fetchone()[0]
+        self.assertEqual(actual, bytes(expected))
+
+        # Also verify a slice that includes index 0
+        expected2 = bytearray(self.data)
+        expected2[9::-2] = b"12345"
+        self.blob[9::-2] = b"12345"
+        actual2 = self.cx.execute("select b from test").fetchone()[0]
+        self.assertEqual(actual2, bytes(expected2))
+
     def test_blob_mapping_invalid_index_type(self):
         msg = "indices must be integers"
         with self.assertRaisesRegex(TypeError, msg):

Misc/NEWS.d/next/Library/2026-05-26-15-53-50.gh-issue-150449.GfDWxl.rst

@@ -0,0 +1,3 @@
+Fix :class:`sqlite3.Blob` raising :exc:`SystemError` (or :exc:`ValueError`
+on recent versions) when reading or writing with a negative-step slice such
+as ``blob[9:0:-2]``.

Modules/_sqlite/blob.c

@@ -445,7 +445,20 @@ subscript_slice(pysqlite_Blob *self, PyObject *item)
         return read_multiple(self, len, start);
     }
 
-    PyObject *blob = read_multiple(self, stop - start, start);
+    // For positive step: read the contiguous range [start, stop) and pick
+    // every step-th byte.  For negative step: read the contiguous range
+    // [start+(len-1)*step, start] and pick bytes in reverse stride order.
+    Py_ssize_t read_offset, read_length;
+    if (step > 0) {
+        read_offset = start;
+        read_length = stop - start;
+    }
+    else {
+        read_offset = start + (len - 1) * step;
+        read_length = (len - 1) * (-step) + 1;
+    }
+
+    PyObject *blob = read_multiple(self, read_length, read_offset);
     if (blob == NULL) {
         return NULL;
     }
@@ -456,10 +469,18 @@ subscript_slice(pysqlite_Blob *self, PyObject *item)
         return NULL;
     }
     char *res_buf = PyBytesWriter_GetData(writer);
-
     char *blob_buf = PyBytes_AS_STRING(blob);
-    for (Py_ssize_t i = 0, j = 0; i < len; i++, j += step) {
-        res_buf[i] = blob_buf[j];
+
+    if (step > 0) {
+        for (Py_ssize_t i = 0, j = 0; i < len; i++, j += step) {
+            res_buf[i] = blob_buf[j];
+        }
+    }
+    else {
+        Py_ssize_t neg_step = -step;
+        for (Py_ssize_t i = 0, j = (len - 1) * neg_step; i < len; i++, j -= neg_step) {
+            res_buf[i] = blob_buf[j];
+        }
     }
     Py_DECREF(blob);
     return PyBytesWriter_Finish(writer);
@@ -549,13 +570,34 @@ ass_subscript_slice(pysqlite_Blob *self, PyObject *item, PyObject *value)
         rc = inner_write(self, vbuf.buf, len, start);
     }
     else {
-        PyObject *blob_bytes = read_multiple(self, stop - start, start);
+        // For positive step: read the contiguous range [start, stop) and
+        // update every step-th byte.  For negative step: read the contiguous
+        // range [start+(len-1)*step, start] and update bytes in reverse
+        // stride order.
+        Py_ssize_t read_offset, read_length;
+        if (step > 0) {
+            read_offset = start;
+            read_length = stop - start;
+        }
+        else {
+            read_offset = start + (len - 1) * step;
+            read_length = (len - 1) * (-step) + 1;
+        }
+        PyObject *blob_bytes = read_multiple(self, read_length, read_offset);
         if (blob_bytes != NULL) {
             char *blob_buf = PyBytes_AS_STRING(blob_bytes);
-            for (Py_ssize_t i = 0, j = 0; i < len; i++, j += step) {
-                blob_buf[j] = ((char *)vbuf.buf)[i];
+            if (step > 0) {
+                for (Py_ssize_t i = 0, j = 0; i < len; i++, j += step) {
+                    blob_buf[j] = ((char *)vbuf.buf)[i];
+                }
+            }
+            else {
+                Py_ssize_t neg_step = -step;
+                for (Py_ssize_t i = 0, j = (len - 1) * neg_step; i < len; i++, j -= neg_step) {
+                    blob_buf[j] = ((char *)vbuf.buf)[i];
+                }
             }
-            rc = inner_write(self, blob_buf, stop - start, start);
+            rc = inner_write(self, blob_buf, read_length, read_offset);
             Py_DECREF(blob_bytes);
         }
     }