FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-80254: Disallow recursive usage of cursors in `sqlite3` converters by erlend-aasland · Pull Request #29054 · python/cpython · GitHub

/ cpython Public
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension .c  (1) .py  (1) .rst  (1) All 3 file types selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
39 changes: 39 additions & 0 deletions Lib/test/test_sqlite3/test_regression.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import functools

from test import support
from unittest.mock import patch
from test.test_sqlite3.test_dbapi import memory_database, managed_connect, cx_limit


Expand Down Expand Up @@ -469,5 +470,43 @@ def test_executescript_step_through_select(self):
self.assertEqual(steps, values)


class RecursiveUseOfCursors(unittest.TestCase):
# GH-80254: sqlite3 should not segfault for recursive use of cursors.
msg = "Recursive use of cursors not allowed"

def setUp(self):
self.con = sqlite.connect(":memory:",
detect_types=sqlite.PARSE_COLNAMES)
self.cur = self.con.cursor()
self.cur.execute("create table test(x foo)")
self.cur.executemany("insert into test(x) values (?)",
[("foo",), ("bar",)])

def tearDown(self):
self.cur.close()
self.con.close()

def test_recursive_cursor_init(self):
conv = lambda x: self.cur.__init__(self.con)
Comment thread
erlend-aasland marked this conversation as resolved.
with patch.dict(sqlite.converters, {"INIT": conv}):
self.cur.execute(f'select x as "x [INIT]", x from test')
self.assertRaisesRegex(sqlite.ProgrammingError, self.msg,
self.cur.fetchall)

def test_recursive_cursor_close(self):
conv = lambda x: self.cur.close()
Comment thread
erlend-aasland marked this conversation as resolved.
with patch.dict(sqlite.converters, {"CLOSE": conv}):
self.cur.execute(f'select x as "x [CLOSE]", x from test')
self.assertRaisesRegex(sqlite.ProgrammingError, self.msg,
self.cur.fetchall)

def test_recursive_cursor_iter(self):
conv = lambda x, l=[]: self.cur.fetchone() if l else l.append(None)
with patch.dict(sqlite.converters, {"ITER": conv}):
self.cur.execute(f'select x as "x [ITER]", x from test')
self.assertRaisesRegex(sqlite.ProgrammingError, self.msg,
self.cur.fetchall)


if __name__ == "__main__":
unittest.main()
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Raise :exc:`~sqlite3.ProgrammingError` instead of segfaulting on recursive
usage of cursors in :mod:`sqlite3` converters. Patch by Sergey Fedoseev.
31 changes: 24 additions & 7 deletions Modules/_sqlite/cursor.c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,17 @@
#include "clinic/cursor.c.h"
#undef clinic_state

static inline int
check_cursor_locked(pysqlite_Cursor *cur)
{
if (cur->locked) {
PyErr_SetString(cur->connection->ProgrammingError,
"Recursive use of cursors not allowed.");
return 0;
}
return 1;
}

/*[clinic input]
module _sqlite3
class _sqlite3.Cursor "pysqlite_Cursor *" "clinic_state()->CursorType"
Expand Down Expand Up @@ -70,6 +81,10 @@ pysqlite_cursor_init_impl(pysqlite_Cursor *self,
pysqlite_Connection *connection)
/*[clinic end generated code: output=ac59dce49a809ca8 input=23d4265b534989fb]*/
{
if (!check_cursor_locked(self)) {
return -1;
}

Py_INCREF(connection);
Py_XSETREF(self->connection, connection);
Py_CLEAR(self->statement);
Expand Down Expand Up @@ -447,13 +462,9 @@ static int check_cursor(pysqlite_Cursor* cur)
return 0;
}

if (cur->locked) {
PyErr_SetString(cur->connection->state->ProgrammingError,
"Recursive use of cursors not allowed.");
return 0;
}

return pysqlite_check_thread(cur->connection) && pysqlite_check_connection(cur->connection);
return (pysqlite_check_thread(cur->connection)
&& pysqlite_check_connection(cur->connection)
&& check_cursor_locked(cur));
}

static int
Expand Down Expand Up @@ -847,7 +858,9 @@ pysqlite_cursor_iternext(pysqlite_Cursor *self)
return NULL;
}

self->locked = 1; // GH-80254: Prevent recursive use of cursors.
PyObject *row = _pysqlite_fetch_one_row(self);
self->locked = 0;
if (row == NULL) {
return NULL;
}
Expand Down Expand Up @@ -1011,6 +1024,10 @@ static PyObject *
pysqlite_cursor_close_impl(pysqlite_Cursor *self)
/*[clinic end generated code: output=b6055e4ec6fe63b6 input=08b36552dbb9a986]*/
{
if (!check_cursor_locked(self)) {
return NULL;
}

if (!self->connection) {
PyTypeObject *tp = Py_TYPE(self);
pysqlite_state *state = pysqlite_get_state_by_type(tp);
Expand Down

Back | FazBrowse Home | New Git URL