Skip to content

sqlite3.Connection.blobopen() can fail with OverflowError on large rowids #100370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
TheCatPlusPlus opened this issue Dec 20, 2022 · 1 comment · Fixed by #103902
Closed

sqlite3.Connection.blobopen() can fail with OverflowError on large rowids #100370

TheCatPlusPlus opened this issue Dec 20, 2022 · 1 comment · Fixed by #103902
Assignees
Labels
3.11 only security fixes 3.12 only security fixes topic-sqlite3 type-bug An unexpected behavior, bug, or error

Comments

@TheCatPlusPlus
Copy link

TheCatPlusPlus commented Dec 20, 2022

Bug report

blobopen internally uses int to hold the requested rowid ([1], [2]), but SQLite rowids are actually 64-bit integers:

int sqlite3_blob_open(
  sqlite3*,
  const char *zDb,
  const char *zTable,
  const char *zColumn,
  sqlite3_int64 iRow, // <-- the rowid parameter
  int flags,
  sqlite3_blob **ppBlob
);

This makes an attempt to open a blob with large rowid raise an OverflowError when Python is compiled with 32-bit int, which is the case on Windows even when compiling as 64-bit application.

This might seem like an edge case, but any INTEGER PRIMARY KEY in a rowid table aliases rowid, which means any application that uses non-autoincrement primary keys (e.g. timestamps, checksums) is likely to hit this very trivially -- I know I did on basically the first insert. You don't need to have more than 2**32 rows or anything like that for this to happen.

100% reproducible with:

import sqlite3

con = sqlite3.connect(':memory:')
rowid = 2**32

con.execute("create table t(t blob)")
con.execute("insert into t(rowid, t) values (?, zeroblob(1))", (rowid,))
con.blobopen('t', 't', rowid)

Expected: nothing (i.e. successful call)
Instead:

Traceback (most recent call last):
  File "E:\Temp\blob.py", line 10, in <module>
    con.blobopen('t', 't', rowid)
OverflowError: Python int too large to convert to C int

Your environment

  • CPython versions tested on: 3.11.0 (main, Oct 24 2022, 18:26:48) [MSC v.1933 64 bit (AMD64)], 3.12.0a3+ (heads/main-dirty:cb60b6131b, Dec 20 2022, 14:37:41) [MSC v.1934 64 bit (AMD64)]
  • Operating system and architecture: Windows x64

Linked PRs

@TheCatPlusPlus TheCatPlusPlus added the type-bug An unexpected behavior, bug, or error label Dec 20, 2022
@erlend-aasland erlend-aasland moved this to TODO: Bugs in sqlite3 issues Jan 22, 2023
@erlend-aasland erlend-aasland self-assigned this Jan 22, 2023
@erlend-aasland erlend-aasland moved this from TODO: Bugs to In Progress in sqlite3 issues Apr 26, 2023
@erlend-aasland
Copy link
Contributor

Sorry for the late reply. I'm preparing a PR for this; I'll put it up tomorrow.

erlend-aasland added a commit to erlend-aasland/cpython that referenced this issue Apr 26, 2023
erlend-aasland added a commit to erlend-aasland/cpython that referenced this issue Apr 26, 2023
@github-project-automation github-project-automation bot moved this from In Progress to Done in sqlite3 issues May 7, 2023
@erlend-aasland erlend-aasland added 3.11 only security fixes 3.12 only security fixes labels May 8, 2023
erlend-aasland added a commit to erlend-aasland/cpython that referenced this issue May 8, 2023
jbower-fb pushed a commit to jbower-fb/cpython that referenced this issue May 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.11 only security fixes 3.12 only security fixes topic-sqlite3 type-bug An unexpected behavior, bug, or error
Projects
Status: Done
Development

Successfully merging a pull request may close this issue.

3 participants