Skip to content

gh-150449: Fix sqlite3.Blob crash with negative-step slices#150450

Open
ever0de wants to merge 1 commit into
python:mainfrom
ever0de:gh-150449-fix-sqlite-blob-negative-step-slice
Open

gh-150449: Fix sqlite3.Blob crash with negative-step slices#150450
ever0de wants to merge 1 commit into
python:mainfrom
ever0de:gh-150449-fix-sqlite-blob-negative-step-slice

Conversation

@ever0de
Copy link
Copy Markdown
Contributor

@ever0de ever0de commented May 26, 2026

Reading or writing a sqlite3.Blob with a negative-step slice such as blob[9:0:-2] caused a crash (SystemError on older versions, ValueError on current main) because the C code computed stop - start as the read length, which is negative for negative steps.

Fix subscript_slice() and ass_subscript_slice() in Modules/_sqlite/blob.c to handle both positive and negative steps correctly:

  • For step > 1: keep reading [start, stop) and indexing forward as before.
  • For step < -1: read the contiguous range [start+(len-1)*step, start] and index backward with stride -step.

Reading or writing a sqlite3.Blob with a negative-step slice such as
blob[9:0:-2] caused a crash (SystemError on older versions, ValueError
on current main) because the C code computed stop - start as the read
length, which is negative for negative steps.

Fix subscript_slice() and ass_subscript_slice() in Modules/_sqlite/blob.c
to handle both positive and negative steps correctly:
- For step > 1: keep reading [start, stop) and indexing forward as before.
- For step < -1: read the contiguous range [start+(len-1)*step, start]
  and index backward with stride -step.
@ever0de ever0de force-pushed the gh-150449-fix-sqlite-blob-negative-step-slice branch from 561ce7f to 24ade8a Compare May 26, 2026 06:58
@ever0de ever0de marked this pull request as ready for review May 26, 2026 06:58
@ever0de ever0de requested a review from erlend-aasland as a code owner May 26, 2026 06:58
Comment thread Modules/_sqlite/blob.c
// For positive step: read the contiguous range [start, stop) and pick
// every step-th byte. For negative step: read the contiguous range
// [start+(len-1)*step, start] and pick bytes in reverse stride order.
Py_ssize_t read_offset, read_length;
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have an adjust slice function somewhere in the codebase, use the latter instead.

Copy link
Copy Markdown
Member

@picnixz picnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please also exercise negative stepsize when start <= end (it doesn't make sense but still it needs to be checked).

Comment thread Modules/_sqlite/blob.c
}
else {
PyObject *blob_bytes = read_multiple(self, stop - start, start);
// For positive step: read the contiguous range [start, stop) and
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not a contiguous range if step != 1.

@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 26, 2026

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants