sqlite crashes with converters mutating cursor

[sir-sigurd]

BPO	36073
Nosy	@berkerpeksag, @sir-sigurd, @erlend-aasland
PRs	bpo-36073: Raise ProgrammingError on recursive usage of cursors in sqlite converters #11984 gh-80254: Disallow recursive usage of cursors in sqlite3 converters #29054

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2019-02-22.07:44:47.863>
labels = ['extension-modules', '3.7', '3.8', 'type-crash']
title = 'sqlite crashes with converters mutating cursor'
updated_at = <Date 2021-10-19.09:48:51.905>
user = 'https://github.com/sir-sigurd'

bugs.python.org fields:

activity = <Date 2021-10-19.09:48:51.905>
actor = 'erlendaasland'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Extension Modules']
creation = <Date 2019-02-22.07:44:47.863>
creator = 'sir-sigurd'
dependencies = []
files = []
hgrepos = []
issue_num = 36073
keywords = ['patch']
message_count = 3.0
messages = ['336283', '400335', '400336']
nosy_count = 4.0
nosy_names = ['ghaering', 'berker.peksag', 'sir-sigurd', 'erlendaasland']
pr_nums = ['11984', '29054']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue36073'
versions = ['Python 3.7', 'Python 3.8']

[sir-sigurd]

It's somewhat similar to bpo-10811, but for converter function:

In [197]: import sqlite3 as sqlite
...: con = sqlite.connect(':memory:', detect_types=sqlite.PARSE_COLNAMES)
...: cur = con.cursor()
...: sqlite.converters['CURSOR_INIT'] = lambda x: cur.__init__(con)
...:
...: cur.execute('create table test(x foo)')
...: cur.execute('insert into test(x) values (?)', ('foo',))
...: cur.execute('select x as "x [CURSOR_INIT]", x from test')
...:
[1] 25718 segmentation fault python manage.py shell

Similar to bpo-10811, proposed patch raises ProgrammingError instead of crashing.

[erlend-aasland]

After #72071 (bpo-44976) there is no longer a segfault.

I suggest to expand the test suite with the reproducer Sergey provided.

[erlend-aasland]

Er, a little bit too fast there. There is still a crash, but it is of course postponed bco. bpo-44976. New reproducer:

import sqlite3 as sqlite
con = sqlite.connect(':memory:', detect_types=sqlite.PARSE_COLNAMES)
cur = con.cursor()
sqlite.converters['CURSOR_INIT'] = lambda x: cur.__init__(con)

cur.execute('create table test(x foo)')
cur.execute('insert into test(x) values (?)', ('foo',))
for row in cur.execute('select x as "x [CURSOR_INIT]", x from test'):
print(row)

[erlend-aasland]

List of backport PRs:

• 3.10 backport: [3.10] gh-80254: Disallow recursive usage of cursors in sqlite3 converters #92274
• 3.9 backport: [3.9] gh-80254: Disallow recursive usage of cursors in sqlite3 converters #92278
• 3.8 backport: [3.8] gh-80254: Disallow recursive usage of cursors in sqlite3 converters #92333
• 3.7 backport: [3.7] gh-80254: Disallow recursive usage of cursors in sqlite3 converters #92334