gh-152817: Prevent deletion of sqlite3 `cursor.row_factory` attr, missed from: gh-149738 by stestagg · Pull Request #152818 · python/cpython

stestagg · 2026-07-01T18:43:56Z

gh-149738 prevents deletion of row_factory and text_factory attributes on a sqlite3 connection, this PR applies that fix to cursor objects too, to avoid a similar segfault:

import sqlite3

cur = sqlite3.connect(":memory:").cursor()
del cur.row_factory
cur.execute("select 1").fetchone()

I've piggy-backed off the existing docs change and blurb as that seems to cover this already

Issue: segfault after deleting row_factory attr of sqlite3 cursor #152817

stestagg · 2026-07-01T18:47:50Z

@sepehr-rs - You were the author of the original, are you able to take a look? Thanks in advance!

sepehr-rs

Hi @stestagg, thank you for reaching out to me on this!
I think your change is good, but I believe you should also add a versionchanged:: next note under the Cursor.row_factory attribute docs, mirroring what was added for Connection.row_factory/text_factory. Besides that, +1 from me.

stestagg · 2026-07-02T07:44:14Z

Hi @stestagg, thank you for reaching out to me on this! I think your change is good, but I believe you should also add a versionchanged:: next note under the Cursor.row_factory attribute docs, mirroring what was added for Connection.row_factory/text_factory. Besides that, +1 from me.

As I understand it, gh-149738 already altered the doc for the Cursor.row_factory attr (as well as for the Connection.row_factory), just not the code:

cpython/Doc/library/sqlite3.rst

Lines 1718 to 1719 in f3bf8ab

    
           .. versionchanged:: next 
        
              Deleting the ``row_factory`` attribute is no longer allowed.

It's likely I've misunderstood/missed something here!

sepehr-rs · 2026-07-02T07:58:32Z

As I understand it, gh-149738 already altered the doc for the Cursor.row_factory attr (as well as for the Connection.row_factory), just not the code:

Oh, you're right. I must have forgotten about that. This is a real gap, thanks for checking this! :)

stestagg · 2026-07-02T13:53:54Z

There's a related issue that I uncovered above, if you create a Connection or Cursor without calling __init__ on it (why would you do this?) then row_factory/text_factory fields are never initialized, so then you get a segfault anyway.

To me, there's a few options:

Make the users of row_factory/text_factory handle NULL like None, it's a cheap check, then having a NULL in this fields doesn't matter, we can remove the 'not allowed to del the attribute' code which makes things a bit simpler.
Move the current field initialisation into tp_new (currently we don't have one), so that we never have an object in python space with row_factory=NULL, we'd have to keep the delattr guards, but that's fine, why would you delattr this anyway
Just ignore the above issue, get this PR in, and raise a new issue to fix the new/init problem.

I'm not sure of the best approach tbh.

sobolevn · 2026-07-03T11:02:08Z

I propose to split this into 2 PRs: one with the deletion, one with the assignement. Let's keep this PR focused on one thing :)

stestagg · 2026-07-03T11:41:38Z

@sobolevn I propose to split this into 2 PRs: one with the deletion, one with the assignement. Let's keep this PR focused on one thing :)

fair point, reverted, I'll raise the other part separately

stestagg · 2026-08-19T15:48:27Z

Hi! Is there anything I can do to progress this?

I'll do a rebase on main to check everything's ok, and try to clear the test failure (seems like they're unrelated)

…egfault

prevent segfault and bring behaviour in line with docs

re-initialize in tp_init (because of tp_clear calls) and also guard each use of row_factory and text_factory with an explicit NULL check. Keep the previous delattr guards, because who would be calling __delattr__ on these anyway. I'm imagining someone will suggest removing some of these changes, but something something seek forgiveness something.

…n, keeping the underlying delattr guards

serhiy-storchaka

LGTM besides few nitpicks.

serhiy-storchaka · 2026-08-20T11:05:09Z

 };

+static PyObject *
+cursor_get_row_factory(PyObject *op, void *closure)


Style nitpick: use Py_UNUSED(closure).

serhiy-storchaka · 2026-08-20T11:05:29Z

+static PyObject *
+cursor_get_row_factory(PyObject *op, void *closure)
+{
+    pysqlite_Cursor *self = (pysqlite_Cursor *)op;


Use _pysqlite_Cursor_CAST().

serhiy-storchaka · 2026-08-20T11:05:41Z

+cursor_set_row_factory(PyObject *op, PyObject *value, void *closure)
+{
+    pysqlite_Cursor *self = (pysqlite_Cursor *)op;


miss-islington-app · 2026-08-21T07:58:53Z

Thanks @stestagg for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14, 3.15.
🐍🍒⛏🤖

miss-islington-app · 2026-08-21T07:58:58Z

Sorry, @stestagg and @serhiy-storchaka, I could not cleanly backport this to 3.15 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8e96dd6f25b53f0773d3f3f2a898eaa1501ee92e 3.15

miss-islington-app · 2026-08-21T07:59:03Z

Sorry, @stestagg and @serhiy-storchaka, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8e96dd6f25b53f0773d3f3f2a898eaa1501ee92e 3.14

miss-islington-app · 2026-08-21T07:59:08Z

Sorry, @stestagg and @serhiy-storchaka, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8e96dd6f25b53f0773d3f3f2a898eaa1501ee92e 3.13

bedevere-app · 2026-08-21T08:26:27Z

GH-156160 is a backport of this pull request to the 3.15 branch.

bedevere-app · 2026-08-21T08:26:32Z

GH-156161 is a backport of this pull request to the 3.14 branch.

bedevere-app · 2026-08-21T08:26:33Z

GH-156162 is a backport of this pull request to the 3.13 branch.

…GH-152818) (GH-156162) (cherry picked from commit 8e96dd6) Co-authored-by: Steve Stagg <stestagg@gmail.com>

…GH-152818) (GH-156161) (cherry picked from commit 8e96dd6) Co-authored-by: Steve Stagg <stestagg@gmail.com>

stestagg · 2026-08-21T09:41:05Z

Thanks @serhiy-storchaka! I was planning on looking at the comments today, but you saved me :)

stestagg requested a review from erlend-aasland as a code owner July 1, 2026 18:43

bedevere-app Bot mentioned this pull request Jul 1, 2026

segfault after deleting row_factory attr of sqlite3 cursor #152817

Closed

bedevere-app Bot added the awaiting review label Jul 1, 2026

sepehr-rs reviewed Jul 2, 2026

View reviewed changes

sobolevn reviewed Jul 2, 2026

View reviewed changes

Comment thread Modules/_sqlite/cursor.c

stestagg mentioned this pull request Jul 3, 2026

sqlite3 Connection and Cursor segfault if __init__ is bypassed (by subclass or __new__ call) #152954

Open

stestagg added 6 commits August 19, 2026 16:48

Add test showing del cursor.row_factory then executing query causes s…

beb6a26

…egfault

Add __delattr__ guard to sqlite3 cursor.row_factory attr to

6db8641

prevent segfault and bring behaviour in line with docs

Amend the existing NEWS blurb

3d7bd8f

Put back the quoting around attribute mentions

f09a339

Revert the fix for code that doesn't call __init__on Cursor/Connectio…

110140b

…n, keeping the underlying delattr guards

stestagg force-pushed the main branch from a00cb59 to 110140b Compare August 19, 2026 15:48

serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Aug 20, 2026

serhiy-storchaka approved these changes Aug 20, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting review labels Aug 20, 2026

Apply the style nitpicks.

3d4a61a

serhiy-storchaka enabled auto-merge (squash) August 21, 2026 07:28

serhiy-storchaka merged commit 8e96dd6 into python:main Aug 21, 2026
54 checks passed

bedevere-app Bot removed the awaiting merge label Aug 21, 2026

miss-islington-app Bot assigned serhiy-storchaka Aug 21, 2026

This was referenced Aug 21, 2026

[3.15] gh-152817: Prevent deletion of sqlite3 cursor.row_factory attr (GH-152818) #156160

Open

[3.14] gh-152817: Prevent deletion of sqlite3 cursor.row_factory attr (GH-152818) #156161

Merged

serhiy-storchaka mentioned this pull request Aug 21, 2026

[3.13] gh-152817: Prevent deletion of sqlite3 cursor.row_factory attr (GH-152818) #156162

Merged

bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Aug 21, 2026

bedevere-app Bot removed needs backport to 3.14 bugs and security fixes needs backport to 3.13 bugs and security fixes labels Aug 21, 2026

serhiy-storchaka added a commit that referenced this pull request Aug 21, 2026

[3.13] gh-152817: Prevent deletion of sqlite3 cursor.row_factory attr (…

4f3afba

…GH-152818) (GH-156162) (cherry picked from commit 8e96dd6) Co-authored-by: Steve Stagg <stestagg@gmail.com>

serhiy-storchaka added a commit that referenced this pull request Aug 21, 2026

[3.14] gh-152817: Prevent deletion of sqlite3 cursor.row_factory attr (…

8288442

…GH-152818) (GH-156161) (cherry picked from commit 8e96dd6) Co-authored-by: Steve Stagg <stestagg@gmail.com>

Uh oh!

Uh oh!

Conversation

stestagg commented Jul 1, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stestagg commented Jul 1, 2026

Uh oh!

sepehr-rs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

stestagg commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sepehr-rs commented Jul 2, 2026

Uh oh!

stestagg commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sobolevn commented Jul 3, 2026

Uh oh!

stestagg commented Jul 3, 2026

Uh oh!

stestagg commented Aug 19, 2026

Uh oh!

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Uh oh!

serhiy-storchaka Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

serhiy-storchaka Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

serhiy-storchaka Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

miss-islington-app Bot commented Aug 21, 2026

Uh oh!

miss-islington-app Bot commented Aug 21, 2026

Uh oh!

miss-islington-app Bot commented Aug 21, 2026

Uh oh!

miss-islington-app Bot commented Aug 21, 2026

Uh oh!

bedevere-app Bot commented Aug 21, 2026

Uh oh!

bedevere-app Bot commented Aug 21, 2026

Uh oh!

bedevere-app Bot commented Aug 21, 2026

Uh oh!

stestagg commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

stestagg commented Jul 1, 2026 •

edited by bedevere-app Bot

Loading

stestagg commented Jul 2, 2026 •

edited

Loading

stestagg commented Jul 2, 2026 •

edited

Loading