Repository navigation
Commit 6f3eae8
committed
sqlite3: fix Blob.__setitem__ negative-step slice write
In the step != 1 branch of Blob.ass_subscript, the loop used
i_in_temp += step as usize
where step is isize. For negative steps (e.g. step = -2),
(-2isize) as usize = 18446744073709551614
causing an out-of-bounds panic whenever slice_len >= 2.
Fix: use SaturatedSliceIter (already used by the read path) to iterate
over the correct absolute blob indices, then map each index back to a
temp buffer offset via abs_idx - range_start.
Also fix a Clippy lint: replace
val < 0 || val > 255
with the idiomatic
!(0..=255).contains(&val)
Add a regression test in extra_tests/snippets/stdlib_sqlite.py that
exercises blob[9:0:-2] (negative step, slice_len=5).1 parent 95abd48 commit 6f3eae8
2 files changed
Lines changed: 18 additions & 7 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -2571,7 +2571,7 @@ mod _sqlite3 { | |||
| 2571 | 2571 | // Mirror CPython ass_subscript_index: use PyLong_AsLong, treat any | |
| 2572 | 2572 | // overflow (e.g. 2**65) as -1, then validate the [0, 255] range. | |
| 2573 | 2573 | let val = int_val.as_bigint().to_i64().unwrap_or(-1); | |
| 2574 | - if val < 0 || val > 255 { | ||
| 2574 | + if !(0..=255).contains(&val) { | ||
| 2575 | 2575 | return Err(vm.new_value_error("byte must be in range(0, 256)")); | |
| 2576 | 2576 | } | |
| 2577 | 2577 | let ret = inner.blob.write_single(val as u8, index); | |
@@ -2612,25 +2612,25 @@ mod _sqlite3 { | |||
| 2612 | 2612 | self.check(ret, vm) | |
| 2613 | 2613 | } else { | |
| 2614 | 2614 | let span_len = range.end - range.start; | |
| 2615 | + let range_start = range.start; | ||
| 2615 | 2616 | let mut temp_buf = vec![0u8; span_len]; | |
| 2616 | 2617 | ||
| 2617 | 2618 | let ret = inner.blob.read( | |
| 2618 | 2619 | temp_buf.as_mut_ptr().cast(), | |
| 2619 | 2620 | span_len as c_int, | |
| 2620 | - range.start as c_int, | ||
| 2621 | + range_start as c_int, | ||
| 2621 | 2622 | ); | |
| 2622 | 2623 | self.check(ret, vm)?; | |
| 2623 | 2624 | ||
| 2624 | - let mut i_in_temp: usize = 0; | ||
| 2625 | - for i_in_src in 0..slice_len { | ||
| 2626 | - temp_buf[i_in_temp] = buf[i_in_src]; | ||
| 2627 | - i_in_temp += step as usize; | ||
| 2625 | + let iter = SaturatedSliceIter::from_adjust_indices(range, step, slice_len); | ||
| 2626 | + for (i_in_src, abs_idx) in iter.enumerate() { | ||
| 2627 | + temp_buf[abs_idx - range_start] = buf[i_in_src]; | ||
| 2628 | 2628 | } | |
| 2629 | 2629 | ||
| 2630 | 2630 | let ret = inner.blob.write( | |
| 2631 | 2631 | temp_buf.as_ptr().cast(), | |
| 2632 | 2632 | span_len as c_int, | |
| 2633 | - range.start as c_int, | ||
| 2633 | + range_start as c_int, | ||
| 2634 | 2634 | ); | |
| 2635 | 2635 | self.check(ret, vm) | |
| 2636 | 2636 | } | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -53,3 +53,14 @@ def finalize(self): | |||
| 53 | 53 | cx.create_aggregate("aggtxt", 1, AggrText) | |
| 54 | 54 | cur.execute("select aggtxt(key) from foo") | |
| 55 | 55 | assert cur.fetchone()[0] == "341011" | |
| 56 | + | ||
| 57 | + # Blob extended-slice assignment with negative step | ||
| 58 | + cx.execute("CREATE TABLE blobtest(b BLOB)") | ||
| 59 | + data = b"this blob data string is exactly fifty bytes long!" | ||
| 60 | + cx.execute("INSERT INTO blobtest(b) VALUES (?)", (data,)) | ||
| 61 | + blob = cx.blobopen("blobtest", "b", 1) | ||
| 62 | + blob[9:0:-2] = b"12345" # writes to indices 9, 7, 5, 3, 1 | ||
| 63 | + actual = cx.execute("select b from blobtest").fetchone()[0] | ||
| 64 | + expected = b"t5i4 3l2b1" + data[10:] | ||
| 65 | + assert actual == expected, f"got {actual!r}, expected {expected!r}" | ||
| 66 | + blob.close() | ||
0 commit comments