Issue #24257: Fixed segmentation fault in sqlite3.Row constructor with faked

cursor type.

diff --git a/Lib/sqlite3/test/factory.py b/Lib/sqlite3/test/factory.py
index 0813a13f4087cdc5ce8c694eb315a686008926a0..f4b842834901a95af1228a36aba14ad01da12212 100644 (file)
--- a/Lib/sqlite3/test/factory.py
+++ b/Lib/sqlite3/test/factory.py
@@ -170,6 +170,14 @@ class RowFactoryTests(unittest.TestCase):
         self.assertEqual(list(reversed(row)), list(reversed(as_tuple)))
         self.assertIsInstance(row, Sequence)
 
+    def CheckFakeCursorClass(self):
+        # Issue #24257: Incorrect use of PyObject_IsInstance() caused
+        # segmentation fault.
+        class FakeCursor(str):
+            __class__ = sqlite.Cursor
+        cur = self.con.cursor(factory=FakeCursor)
+        self.assertRaises(TypeError, sqlite.Row, cur, ())
+
     def tearDown(self):
         self.con.close()
 

diff --git a/Misc/NEWS b/Misc/NEWS
index cdcaff23ba82e17c391d45f6f49ce264048e2b58..65943de69414e9c082d6567c129d3247c70c3f2d 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -18,6 +18,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #24257: Fixed segmentation fault in sqlite3.Row constructor with faked
+  cursor type.
+
 - Issue #22107: tempfile.gettempdir() and tempfile.mkdtemp() now try again
   when a directory with the chosen name already exists on Windows as well as
   on Unix.  tempfile.mkstemp() now fails early if parent directory is not

diff --git a/Modules/_sqlite/row.c b/Modules/_sqlite/row.c
index 02373f002ea01ff9f84585788b2b9d014d8608d8..9ebe7b7b81fb4dbd3dbd8def343e4a43637af1fb 100644 (file)
--- a/Modules/_sqlite/row.c
+++ b/Modules/_sqlite/row.c
@@ -47,7 +47,7 @@ pysqlite_row_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
     if (!PyArg_ParseTuple(args, "OO", &cursor, &data))
         return NULL;
 
-    if (!PyObject_IsInstance((PyObject*)cursor, (PyObject*)&pysqlite_CursorType)) {
+    if (!PyObject_TypeCheck((PyObject*)cursor, &pysqlite_CursorType)) {
         PyErr_SetString(PyExc_TypeError, "instance of cursor required for first argument");
         return NULL;
     }