-
- Notifications
You must be signed in to change notification settings - Fork 33.1k
Closed
Closed
Copy link
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixestopic-sqlite3type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
Description
Bug report
blobopen
internally uses int
to hold the requested rowid ([1], [2]), but SQLite rowids are actually 64-bit integers:
int sqlite3_blob_open( sqlite3*, const char *zDb, const char *zTable, const char *zColumn, sqlite3_int64 iRow, // <-- the rowid parameter int flags, sqlite3_blob **ppBlob );
This makes an attempt to open a blob with large rowid raise an OverflowError
when Python is compiled with 32-bit int
, which is the case on Windows even when compiling as 64-bit application.
This might seem like an edge case, but any INTEGER PRIMARY KEY
in a rowid table aliases rowid, which means any application that uses non-autoincrement primary keys (e.g. timestamps, checksums) is likely to hit this very trivially -- I know I did on basically the first insert. You don't need to have more than 2**32 rows or anything like that for this to happen.
100% reproducible with:
import sqlite3 con = sqlite3.connect(':memory:') rowid = 2**32 con.execute("create table t(t blob)") con.execute("insert into t(rowid, t) values (?, zeroblob(1))", (rowid,)) con.blobopen('t', 't', rowid)
Expected: nothing (i.e. successful call)
Instead:
Traceback (most recent call last): File "E:\Temp\blob.py", line 10, in <module> con.blobopen('t', 't', rowid) OverflowError: Python int too large to convert to C int
Your environment
- CPython versions tested on: 3.11.0 (main, Oct 24 2022, 18:26:48) [MSC v.1933 64 bit (AMD64)], 3.12.0a3+ (heads/main-dirty:cb60b6131b, Dec 20 2022, 14:37:41) [MSC v.1934 64 bit (AMD64)]
- Operating system and architecture: Windows x64
Linked PRs
Metadata
Metadata
Assignees
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixestopic-sqlite3type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
Projects
Status
Done