cpython: 9fc2b6dba9c2 (original) (raw)

Mercurial > cpython

changeset 104089:9fc2b6dba9c2

Issue #27897: Fixed possible crash in sqlite3.Connection.create_collation() if pass invalid string-like object as a name. Patch by Xiang Zhang. [#27897]

Serhiy Storchaka storchaka@gmail.com
date	Tue, 27 Sep 2016 00:16:25 +0300
parents	ac24e5c2fd3e(current diff)c2eb90422aec(diff)
children	96fb3e5c4ae7
files	Misc/NEWS
diffstat	3 files changed, 29 insertions(+), 2 deletions(-)[+] [-] Lib/sqlite3/test/hooks.py 22 Misc/NEWS 3 Modules/_sqlite/connection.c 6

line wrap: on

line diff

--- a/Lib/sqlite3/test/hooks.py +++ b/Lib/sqlite3/test/hooks.py @@ -25,6 +25,11 @@ import unittest import sqlite3 as sqlite class CollationTests(unittest.TestCase):

def CheckCreateCollationNotString(self):

   con = sqlite.connect(":memory:")[](#l1.8)

   with self.assertRaises(TypeError):[](#l1.9)

       con.create_collation(None, lambda x, y: (x > y) - (x < y))[](#l1.10)

+ def CheckCreateCollationNotCallable(self): con = sqlite.connect(":memory:") with self.assertRaises(TypeError) as cm: @@ -36,6 +41,23 @@ class CollationTests(unittest.TestCase): with self.assertRaises(sqlite.ProgrammingError): con.create_collation("coll�", lambda x, y: (x > y) - (x < y))

def CheckCreateCollationBadUpper(self):
```
   class BadUpperStr(str):[](#l1.20)
```
```
       def upper(self):[](#l1.21)
```
```
           return None[](#l1.22)
```

   con = sqlite.connect(":memory:")[](#l1.23)

   mycoll = lambda x, y: -((x > y) - (x < y))[](#l1.24)

   con.create_collation(BadUpperStr("mycoll"), mycoll)[](#l1.25)

```
   result = con.execute("""[](#l1.26)
```
```
       select x from ([](#l1.27)
```
```
       select 'a' as x[](#l1.28)
```
```
       union[](#l1.29)
```
```
       select 'b' as x[](#l1.30)
```

       ) order by x collate mycoll[](#l1.31)

```
       """).fetchall()[](#l1.32)
```

   self.assertEqual(result[0][0], 'b')[](#l1.33)

   self.assertEqual(result[1][0], 'a')[](#l1.34)

+ @unittest.skipIf(sqlite.sqlite_version_info < (3, 2, 1), 'old SQLite versions crash on this test') def CheckCollationIsUsed(self):

--- a/Misc/NEWS +++ b/Misc/NEWS @@ -47,6 +47,9 @@ Core and Builtins Library ------- +- Issue #27897: Fixed possible crash in sqlite3.Connection.create_collation()

if pass invalid string-like object as a name. Patch by Xiang Zhang. +

Issue #18893: Fix invalid exception handling in Lib/ctypes/macholib/dyld.py. Patch by Madison May.

--- a/Modules/_sqlite/connection.c +++ b/Modules/_sqlite/connection.c @@ -1498,11 +1498,13 @@ pysqlite_connection_create_collation(pys goto finally; }

if (!PyArg_ParseTuple(args, "O!O:create_collation(name, callback)", &PyUnicode_Type, &name, &callable)) {

if (!PyArg_ParseTuple(args, "UO:create_collation(name, callback)",

                     &name, &callable)) {[](#l3.9)
   goto finally;[](#l3.10)

}

uppercase_name = _PyObject_CallMethodId(name, &PyId_upper, NULL);

uppercase_name = _PyObject_CallMethodIdObjArgs((PyObject *)&PyUnicode_Type,

                                              &PyId_upper, name, NULL);[](#l3.15)

if (!uppercase_name) { goto finally; }