Skip to content

sqlite3: Blob slice assignment skips validation for empty slices #150913

Description

@ever0de

Bug report

Bug description:

sqlite3.Blob slice assignment skips type and size validation when the
target slice is empty (start == stop, or any slice whose computed
length is zero).

As a result, assignments that would normally raise TypeError or
IndexError complete silently when the target slice is empty.

This behavior is inconsistent with non-empty sqlite3.Blob slice
assignment and appears to be caused by an early return in
ass_subscript_slice() before validation is performed.

Reproduction

importsqlite3con=sqlite3.connect(":memory:")
con.execute("CREATE TABLE t(b BLOB)")
con.execute("INSERT INTO t VALUES(zeroblob(10))")
con.commit()
blob=con.blobopen("t", "b", 1)
# Non-empty slice — expected behaviorblob[0:3] =b"12345"# IndexErrorblob[0:3] =None# TypeError# Empty slice — BUGblob[5:5] =b"123"# silently succeedsblob[5:5] =None# silently succeeds

Expected behavior

Empty slice assignments should be validated in the same way as non-empty
slice assignments.

blob[5:5] =b"123"

should raise:

IndexError: Blob slice assignment is wrong size

and

blob[5:5] =None

should raise:

TypeError: a bytes-like object is required, not 'NoneType'

Actual behavior

Both assignments complete successfully. The blob remains unchanged and
no exception is raised.

Root cause

In Modules/_sqlite/blob.c, ass_subscript_slice() returns early when
the computed slice length is zero.

Because this early return occurs before the bytes-like object check and
slice-size validation, invalid assignments are silently accepted for
empty slices.

Related

Discovered during review of #150450 (negative-step slice handling for
sqlite3.Blob).

Review discussion:

#150450 (comment)

CPython versions tested on:

3.14

Operating systems tested on:

macOS

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    Status
    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions