Issue #17073: Fix some integer overflows in sqlite3 module.
diff --git a/Modules/_sqlite/connection.c b/Modules/_sqlite/connection.c
index a646513..d89b4c1 100644
--- a/Modules/_sqlite/connection.c
+++ b/Modules/_sqlite/connection.c
@@ -538,39 +538,40 @@
}
}
-void _pysqlite_set_result(sqlite3_context* context, PyObject* py_val)
+static int
+_pysqlite_set_result(sqlite3_context* context, PyObject* py_val)
{
- const char* buffer;
- Py_ssize_t buflen;
- PyObject* stringval;
-
- if ((!py_val) || PyErr_Occurred()) {
- sqlite3_result_null(context);
- } else if (py_val == Py_None) {
+ if (py_val == Py_None) {
sqlite3_result_null(context);
} else if (PyInt_Check(py_val)) {
sqlite3_result_int64(context, (sqlite_int64)PyInt_AsLong(py_val));
} else if (PyLong_Check(py_val)) {
- sqlite3_result_int64(context, PyLong_AsLongLong(py_val));
+ sqlite_int64 value = _pysqlite_long_as_int64(py_val);
+ if (value == -1 && PyErr_Occurred())
+ return -1;
+ sqlite3_result_int64(context, value);
} else if (PyFloat_Check(py_val)) {
sqlite3_result_double(context, PyFloat_AsDouble(py_val));
} else if (PyBuffer_Check(py_val)) {
+ const char* buffer;
+ Py_ssize_t buflen;
if (PyObject_AsCharBuffer(py_val, &buffer, &buflen) != 0) {
PyErr_SetString(PyExc_ValueError, "could not convert BLOB to buffer");
- } else {
- sqlite3_result_blob(context, buffer, buflen, SQLITE_TRANSIENT);
+ return -1;
}
+ sqlite3_result_blob(context, buffer, buflen, SQLITE_TRANSIENT);
} else if (PyString_Check(py_val)) {
sqlite3_result_text(context, PyString_AsString(py_val), -1, SQLITE_TRANSIENT);
} else if (PyUnicode_Check(py_val)) {
- stringval = PyUnicode_AsUTF8String(py_val);
- if (stringval) {
- sqlite3_result_text(context, PyString_AsString(stringval), -1, SQLITE_TRANSIENT);
- Py_DECREF(stringval);
- }
+ PyObject * stringval = PyUnicode_AsUTF8String(py_val);
+ if (!stringval)
+ return -1;
+ sqlite3_result_text(context, PyString_AsString(stringval), -1, SQLITE_TRANSIENT);
+ Py_DECREF(stringval);
} else {
- /* TODO: raise error */
+ return -1;
}
+ return 0;
}
PyObject* _pysqlite_build_py_params(sqlite3_context *context, int argc, sqlite3_value** argv)
@@ -580,7 +581,6 @@
sqlite3_value* cur_value;
PyObject* cur_py_value;
const char* val_str;
- sqlite_int64 val_int;
Py_ssize_t buflen;
void* raw_buffer;
@@ -593,11 +593,7 @@
cur_value = argv[i];
switch (sqlite3_value_type(argv[i])) {
case SQLITE_INTEGER:
- val_int = sqlite3_value_int64(cur_value);
- if(val_int < LONG_MIN || val_int > LONG_MAX)
- cur_py_value = PyLong_FromLongLong(val_int);
- else
- cur_py_value = PyInt_FromLong((long)val_int);
+ cur_py_value = _pysqlite_long_from_int64(sqlite3_value_int64(cur_value));
break;
case SQLITE_FLOAT:
cur_py_value = PyFloat_FromDouble(sqlite3_value_double(cur_value));
@@ -648,6 +644,7 @@
PyObject* args;
PyObject* py_func;
PyObject* py_retval = NULL;
+ int ok;
#ifdef WITH_THREAD
PyGILState_STATE threadstate;
@@ -663,10 +660,12 @@
Py_DECREF(args);
}
+ ok = 0;
if (py_retval) {
- _pysqlite_set_result(context, py_retval);
+ ok = _pysqlite_set_result(context, py_retval) == 0;
Py_DECREF(py_retval);
- } else {
+ }
+ if (!ok) {
if (_enable_callback_tracebacks) {
PyErr_Print();
} else {
@@ -746,8 +745,9 @@
void _pysqlite_final_callback(sqlite3_context* context)
{
- PyObject* function_result = NULL;
+ PyObject* function_result;
PyObject** aggregate_instance;
+ int ok;
#ifdef WITH_THREAD
PyGILState_STATE threadstate;
@@ -764,21 +764,23 @@
}
function_result = PyObject_CallMethod(*aggregate_instance, "finalize", "");
- if (!function_result) {
+ Py_DECREF(*aggregate_instance);
+
+ ok = 0;
+ if (function_result) {
+ ok = _pysqlite_set_result(context, function_result) == 0;
+ Py_DECREF(function_result);
+ }
+ if (!ok) {
if (_enable_callback_tracebacks) {
PyErr_Print();
} else {
PyErr_Clear();
}
_sqlite3_result_error(context, "user-defined aggregate's 'finalize' method raised error", -1);
- } else {
- _pysqlite_set_result(context, function_result);
}
error:
- Py_XDECREF(*aggregate_instance);
- Py_XDECREF(function_result);
-
#ifdef WITH_THREAD
PyGILState_Release(threadstate);
#endif
@@ -935,7 +937,9 @@
rc = SQLITE_DENY;
} else {
if (PyInt_Check(ret)) {
- rc = (int)PyInt_AsLong(ret);
+ rc = _PyInt_AsInt(ret);
+ if (rc == -1 && PyErr_Occurred())
+ rc = SQLITE_DENY;
} else {
rc = SQLITE_DENY;
}
@@ -967,7 +971,7 @@
}
/* abort query if error occurred */
- rc = 1;
+ rc = 1;
} else {
rc = (int)PyObject_IsTrue(ret);
Py_DECREF(ret);
@@ -1337,6 +1341,7 @@
PyGILState_STATE gilstate;
#endif
PyObject* retval = NULL;
+ long longval;
int result = 0;
#ifdef WITH_THREAD
gilstate = PyGILState_Ensure();
@@ -1360,10 +1365,17 @@
goto finally;
}
- result = PyInt_AsLong(retval);
- if (PyErr_Occurred()) {
+ longval = PyLong_AsLongAndOverflow(retval, &result);
+ if (longval == -1 && PyErr_Occurred()) {
+ PyErr_Clear();
result = 0;
}
+ else if (!result) {
+ if (longval > 0)
+ result = 1;
+ else if (longval < 0)
+ result = -1;
+ }
finally:
Py_XDECREF(string1);