gh-118928: sqlite3: correctly bail if sequences of params are used with named placeholders (#119197)

erlend-aasland · web-flow · commit af359cee75e4 · 2024-05-20T09:44:42.000-04:00
diff --git a/Misc/NEWS.d/next/Library/2024-05-19-23-09-36.gh-issue-118928.SznMX1.rst b/Misc/NEWS.d/next/Library/2024-05-19-23-09-36.gh-issue-118928.SznMX1.rst
@@ -0,0 +1,2 @@
+Fix an error where incorrect bindings in :mod:`sqlite3` queries could lead
+to a crash. Patch by Erlend E. Aasland.
diff --git a/Modules/_sqlite/cursor.c b/Modules/_sqlite/cursor.c
@@ -675,6 +675,7 @@ bind_parameters(pysqlite_state *state, pysqlite_Statement *self,
                         "supplied a sequence which requires nameless (qmark) "
                         "placeholders.",
                         i+1, name);
+                return;
             }
 
             if (PyTuple_CheckExact(parameters)) {

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fix an error where incorrect bindings in :mod:`sqlite3` queries could lead
	`2`	`+to a crash. Patch by Erlend E. Aasland.`
Original file line number	Diff line number	Diff line change
`@@ -675,6 +675,7 @@ bind_parameters(pysqlite_state state, pysqlite_Statement self,`
`675`	`675`	`"supplied a sequence which requires nameless (qmark) "`
`676`	`676`	`"placeholders.",`
`677`	`677`	`i+1, name);`
	`678`	`+ return;`
`678`	`679`	`}`
`679`	`680`
`680`	`681`	`if (PyTuple_CheckExact(parameters)) {`