gh-142830: prevent some crashes when mutating sqlite3 callbacks

Lib/test/test_sqlite3/test_dbapi.py

@@ -2029,5 +2029,104 @@ def test_row_is_a_sequence(self):
         self.assertIsInstance(row, Sequence)
 
 
+class CallbackTests(unittest.TestCase):
+
+    def setUp(self):
+        super().setUp()
+        self.cx = sqlite.connect(":memory:")
+        self.addCleanup(self.cx.close)
+        self.cu = self.cx.cursor()
+        self.cu.execute("create table test(a number)")
+
+        class Handler:
+            cx = self.cx
+
+        self.handler_class = Handler
+
+    def assert_not_authorized(self, func, /, *args, **kwargs):
+        with self.assertRaisesRegex(sqlite.DatabaseError, "not authorized"):
+            func(*args, **kwargs)
+
+    def assert_interrupted(self, func, /, *args, **kwargs):
+        with self.assertRaisesRegex(sqlite.OperationalError, "interrupted"):
+            func(*args, **kwargs)
+
+    def assert_invalid_trace(self, func, /, *args, **kwargs):
+        # Exception in trace callbacks are entirely suppressed.
+        pass
+
+    # When a handler has an invalid signature, the exception raised is
+    # the same that would be raised if the handler "negatively" replied.
+
+    def test_authorizer_invalid_signature(self):
+        self.cx.set_authorizer(lambda: None)
+        self.assert_not_authorized(self.cx.execute, "select * from test")
+
+    def test_progress_handler_invalid_signature(self):
+        self.cx.set_progress_handler(lambda x: None, 1)
+        self.assert_interrupted(self.cx.execute, "select * from test")
+
+    def test_trace_callback_invalid_signature_traceback(self):
+        self.cx.set_trace_callback(lambda: None)
+        self.assert_invalid_trace(self.cx.execute, "select * from test")
+
+    # Tests for checking that callback context mutations do not crash.
+    # Regression tests for https://github.com/python/cpython/issues/142830.
+
+    def test_authorizer_concurrent_mutation_in_call(self):
+        class Handler(self.handler_class):
+            def __call__(self, *a, **kw):
+                self.cx.set_authorizer(None)
+                raise ValueError
+
+        self.cx.set_authorizer(Handler())
+        self.assert_not_authorized(self.cx.execute, "select * from test")
+
+    def test_authorizer_concurrent_mutation_with_overflown_value(self):
+        _testcapi = import_helper.import_module("_testcapi")
+
+        class Handler(self.handler_class):
+            def __call__(self, *a, **kw):
+                self.cx.set_authorizer(None)
+                # We expect 'int' at the C level, so this one will raise
+                # when converting via PyLong_Int().
+                return _testcapi.INT_MAX + 1
+
+        self.cx.set_authorizer(Handler())
+        self.assert_not_authorized(self.cx.execute, "select * from test")
+
+    def test_progress_handler_concurrent_mutation_in_call(self):
+        class Handler(self.handler_class):
+            def __call__(self, *a, **kw):
+                self.cx.set_authorizer(None)
+                raise ValueError
+
+        self.cx.set_progress_handler(Handler(), 1)
+        self.assert_interrupted(self.cx.execute, "select * from test")
+
+    def test_progress_handler_concurrent_mutation_in_conversion(self):
+        class Handler(self.handler_class):
+            def __bool__(self):
+                # clear the progress handler
+                self.cx.set_progress_handler(None, 1)
+                raise ValueError  # force PyObject_True() to fail
+
+        self.cx.set_progress_handler(Handler.__init__, 1)
+        self.assert_interrupted(self.cx.execute, "select * from test")
+
+    def test_trace_callback_concurrent_mutation_in_call(self):
+        class Handler:
+            def __call__(self, statement):
+                # clear the progress handler
+                self.cx.set_progress_handler(None, 1)
+                raise ValueError
+
+        self.cx.set_trace_callback(Handler())
+        self.assert_invalid_trace(self.cx.execute, "select * from test")
+
+    # TODO(picnixz): increase test coverage for other callbacks
+    # such as 'func', 'step', 'finalize', and 'collation'.
+
+
 if __name__ == "__main__":
     unittest.main()

Makefile.pre.in

@@ -3429,7 +3429,7 @@ MODULE__SSL_DEPS=$(srcdir)/Modules/_ssl.h $(srcdir)/Modules/_ssl/cert.c $(srcdir
 MODULE__TESTCAPI_DEPS=$(srcdir)/Modules/_testcapi/parts.h $(srcdir)/Modules/_testcapi/util.h
 MODULE__TESTLIMITEDCAPI_DEPS=$(srcdir)/Modules/_testlimitedcapi/testcapi_long.h $(srcdir)/Modules/_testlimitedcapi/parts.h $(srcdir)/Modules/_testlimitedcapi/util.h
 MODULE__TESTINTERNALCAPI_DEPS=$(srcdir)/Modules/_testinternalcapi/parts.h
-MODULE__SQLITE3_DEPS=$(srcdir)/Modules/_sqlite/connection.h $(srcdir)/Modules/_sqlite/cursor.h $(srcdir)/Modules/_sqlite/microprotocols.h $(srcdir)/Modules/_sqlite/module.h $(srcdir)/Modules/_sqlite/prepare_protocol.h $(srcdir)/Modules/_sqlite/row.h $(srcdir)/Modules/_sqlite/util.h
+MODULE__SQLITE3_DEPS=$(srcdir)/Modules/_sqlite/connection.h $(srcdir)/Modules/_sqlite/context.h $(srcdir)/Modules/_sqlite/cursor.h $(srcdir)/Modules/_sqlite/microprotocols.h $(srcdir)/Modules/_sqlite/module.h $(srcdir)/Modules/_sqlite/prepare_protocol.h $(srcdir)/Modules/_sqlite/row.h $(srcdir)/Modules/_sqlite/util.h
 MODULE__ZSTD_DEPS=$(srcdir)/Modules/_zstd/_zstdmodule.h $(srcdir)/Modules/_zstd/buffer.h $(srcdir)/Modules/_zstd/zstddict.h
 
 CODECS_COMMON_HEADERS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h $(srcdir)/Modules/cjkcodecs/cjkcodecs.h

Misc/NEWS.d/next/Library/2025-12-28-13-12-40.gh-issue-142830.uEyd6r.rst

@@ -0,0 +1,2 @@
+:mod:`sqlite3`: fix use-after-free crashes when the connection's callbacks
+are mutated during a callback execution. Patch by Bénédikt Tran.

Modules/Setup.stdlib.in

@@ -149,7 +149,7 @@
 # needs -lncurses[w] and -lpanel[w]
 @MODULE__CURSES_PANEL_TRUE@_curses_panel _curses_panel.c
 
-@MODULE__SQLITE3_TRUE@_sqlite3 _sqlite/blob.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c
+@MODULE__SQLITE3_TRUE@_sqlite3 _sqlite/blob.c _sqlite/connection.c _sqlite/context.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c
 
 # needs -lssl and -lcrypt
 @MODULE__SSL_TRUE@_ssl _ssl.c