Skip to content

sqlite3.Blob slice assignment with a step corrupts an immortal bytes singleton #155702

Description

@serhiy-storchaka

Crash report

import sqlite3
cx = sqlite3.connect(":memory:")
cx.execute("create table t(b blob)")
cx.execute("insert into t values (?)", (b"abcdefghij",))
blob = cx.blobopen("t", "b", 1)

blob[5:6:2] = b"\xab"

print(bytes([102]))     # b'\xab', expected b'f'
print(b"f" == b"\xab")  # True

ass_subscript_slice() reads the affected region, patches it and writes it back, using the object returned by read_multiple() as the buffer.
For a single byte that object is an immortal singleton, so writing into it changes the value of that byte in the whole process.

This is a regression in 243d599 (gh-129813, GH-138956), which changed read_multiple() to use PyBytesWriter.
Only main and 3.15 are affected.

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.15pre-release feature fixes, bugs and security fixes3.16new features, bugs and security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-sqlite3type-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    Status
    Todo
    Status
    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions