Skip to content

gh-118928: sqlite3: correctly bail if sequences of params are used with named placeholders #119197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erlend-aasland merged 3 commits into from
May 20, 2024
Merged

gh-118928: sqlite3: correctly bail if sequences of params are used with named placeholders #119197

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4bde862
gh-118928: sqlite3: correctly bail if sequences of params are used wi…
erlend-aasland May 20, 2024
50a746b
We need to refactor bind_parameters() so it returns -1 on error
erlend-aasland May 20, 2024
38f4a7c
Amend news
erlend-aasland May 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
gh-118928: sqlite3: correctly bail if sequences of params are used wi… 
…th named placeholders

Fix up post gh-118929.
  • Loading branch information
@erlend-aasland
erlend-aasland committed May 20, 2024
commit 4bde862e026dbcdddbdb10f1fb75d92b07f559e6
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Library/2024-05-19-23-09-36.gh-issue-118928.SznMX1.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fix an error where incorrect bindings in :mod:`sqlite3` queries could lead
to a crash.
2 changes: 1 addition & 1 deletion Modules/_sqlite/cursor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -670,7 +670,7 @@ bind_parameters(pysqlite_state *state, pysqlite_Statement *self,
for (i = 0; i < num_params; i++) {
const char *name = sqlite3_bind_parameter_name(self->st, i+1);
if (name != NULL && name[0] != '?') {
PyErr_Format(state->ProgrammingError,
return PyErr_Format(state->ProgrammingError,
"Binding %d ('%s') is a named parameter, but you "
"supplied a sequence which requires nameless (qmark) "
"placeholders.",
Expand Down