Skip to content

bpo-31764: Prevent a crash in sqlite3.Cursor.close() in case the Cursor object is uninitialized #3958

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Nov 7, 2017

Conversation

orenmn
Copy link
Contributor

@orenmn orenmn commented Oct 11, 2017

In addition, add a test to test_sqlite to make sure that the crash is no more.

https://bugs.python.org/issue31764

@orenmn
Copy link
Contributor Author

orenmn commented Oct 11, 2017

I wonder whether we should add self->initialized = 0; after the call to PyArg_ParseTuple() in pysqlite_cursor_init(). (At least test_sqlite passes when i add this change.)
This would make sure that a Cursor object wouldn't be partially initialized while self->initialized == 1 .

However, i don't know how to produce code that would create a partially initialized Cursor object such that using it would cause problems.

@@ -890,6 +890,11 @@ PyObject* pysqlite_noop(pysqlite_Connection* self, PyObject* args)

PyObject* pysqlite_cursor_close(pysqlite_Cursor* self, PyObject* args)
{
if (self->connection == NULL) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style nit: I think !foo is more common than foo == NULL in sqlite3 codebase. It would be nice to keep styling consistent within the module.

@@ -0,0 +1,2 @@
Prevent a crash in `sqlite3.Cursor.close()` in case the `Cursor` object is
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use double backticks (``). I tried to explain why single backticks shouldn't be used at #3925 (comment)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not familiar with Sphinx, but i trust you are :)
So maybe https://devguide.python.org/committing/#what-s-new-and-news-entries should also recommend double backticks?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I wasn't aware of that example in the devguide. I will update it, thanks!

@@ -188,6 +188,7 @@ def __init__(self, con):
cur = Cursor(con)
with self.assertRaises(sqlite.ProgrammingError):
cur.execute("select 4+5").fetchall()
self.assertRaises(sqlite.ProgrammingError, cur.close)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ProgrammingError is raised by a lot of things so I wonder if we should add a test for the exception message to make it more future-proof.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All right. Should i also change the assertRaises() that was already in CheckCursorConstructorCallCheck()?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd say let's do it only for new additions to the test.

@bedevere-bot
Copy link

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@orenmn
Copy link
Contributor Author

orenmn commented Oct 12, 2017

@berkerpeksag What do you think about #3958 (comment)?

@serhiy-storchaka serhiy-storchaka self-requested a review October 12, 2017 16:54
@berkerpeksag
Copy link
Member

However, i don't know how to produce code that would create a partially initialized Cursor object such that using it would cause problems.

I agree with you. There is no need to add additional code for hypothetical use cases. We can change it later if we find a way to create a partially initialized Cursor object.

@vstinner vstinner dismissed berkerpeksag’s stale review November 7, 2017 00:09

The author took comments in account.

@vstinner vstinner merged commit edb13ae into python:master Nov 7, 2017
@miss-islington
Copy link
Contributor

Thanks @orenmn for the PR, and @Haypo for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Nov 7, 2017
@bedevere-bot
Copy link

GH-4303 is a backport of this pull request to the 3.6 branch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants