Skip to content

Segfault if pysqlite_Row->description == PyNone #129603

Closed

Description

@erlend-aasland

Crash report

What happened?

Most of the code in Modules/_sqlite/row.c assumes ->description is a tuple. However, it may be None. Since it is possible to craft a sqlite3.Row object "by hand", it is easy to provoke segfauls for paths that involve the PyTuple API and description == Py_None. Any real code would never directly instantiate a row object; it would be implicitly created by the cursor (via the .fetch*() APIs or by iterating on the cursor). However, I don't think we should let a possible segfault hang around.

import sqlite3
cx = sqlite3.connect(":memory:")
cu = cx.cursor()
row = sqlite3.Row(cu, (1,2))
row.keys()  # <= boom

CPython versions tested on:

3.14, 3.13, 3.12, CPython main branch

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

No response

Linked PRs

Activity

  1. added
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Feb 3, 2025
  2. moved this to In Progress in sqlite3 issueson Feb 3, 2025
  3. added 2 commits that reference this issue on Feb 3, 2025
  4. added a commit that references this issue on Feb 9, 2025
  5. moved this from In Progress to Done in sqlite3 issueson Feb 9, 2025
  6. added 3 commits that reference this issue on Feb 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

extension-modulesC modules in the Modules dirtopic-sqlite3type-crashA hard crash of the interpreter, possibly with a core dump

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions