Skip to content

Commit fc9c4db

Browse files
authored
gh-150913: Fix sqlite3.Blob validation for empty slice assignment (GH-150915)
ass_subscript_slice() returned early when the computed slice length was zero, bypassing validation performed for non-empty slices.
1 parent d83d50b commit fc9c4db

3 files changed

Lines changed: 25 additions & 6 deletions

File tree

Lib/test/test_sqlite3/test_dbapi.py

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1400,6 +1400,18 @@ def test_blob_set_empty_slice(self):
14001400
self.blob[0:0] = b""
14011401
self.assertEqual(self.blob[:], self.data)
14021402

1403+
def test_blob_set_empty_slice_wrong_type(self):
1404+
with self.assertRaises(TypeError):
1405+
self.blob[5:5] = None
1406+
1407+
def test_blob_set_empty_slice_wrong_size(self):
1408+
with self.assertRaisesRegex(IndexError, "wrong size"):
1409+
self.blob[5:5] = b"123"
1410+
1411+
def test_blob_set_empty_slice_correct(self):
1412+
self.blob[5:5] = b""
1413+
self.assertEqual(self.blob[:], self.data)
1414+
14031415
def test_blob_set_slice_with_skip(self):
14041416
self.blob[0:10:2] = b"12345"
14051417
actual = self.cx.execute("select b from test").fetchone()[0]
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Fix :class:`sqlite3.Blob` slice assignment to raise
2+
:exc:`TypeError` and :exc:`IndexError` for type and size mismatches
3+
respectively, even when the target slice is empty.

Modules/_sqlite/blob.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -531,21 +531,25 @@ ass_subscript_slice(pysqlite_Blob *self, PyObject *item, PyObject *value)
531531
return -1;
532532
}
533533

534-
if (len == 0) {
535-
return 0;
536-
}
537-
538534
Py_buffer vbuf;
539535
if (PyObject_GetBuffer(value, &vbuf, PyBUF_SIMPLE) < 0) {
540536
return -1;
541537
}
542538

543-
int rc = -1;
544539
if (vbuf.len != len) {
545540
PyErr_SetString(PyExc_IndexError,
546541
"Blob slice assignment is wrong size");
542+
PyBuffer_Release(&vbuf);
543+
return -1;
547544
}
548-
else if (step == 1) {
545+
546+
if (len == 0) {
547+
PyBuffer_Release(&vbuf);
548+
return 0;
549+
}
550+
551+
int rc = -1;
552+
if (step == 1) {
549553
rc = inner_write(self, vbuf.buf, len, start);
550554
}
551555
else {

0 commit comments

Comments
 (0)