Crash report
What happened?
This issue is a result review security advisories GHSA-g74h-5v93-4q3p.
Summary
Modules/_sqlite/connection.c in the sqlite3 standard library module
dereferences a NULL pointer when a user-defined aggregate window
function's value() (or inverse()) method is invoked by SQLite before
step() has ever been called for that window instance. This happens
whenever the window frame is empty for a given output row (e.g. the
first row of a partition with a frame such as
ROWS BETWEEN 1 PRECEDING AND 1 PRECEDING). On a standard (non-debug)
build, this crashes the whole Python process with SIGSEGV.
The problem in the code was found by the Svace static analyzer (ISP RAS) and
was later confirmed by a real REPL crash.
Details
Tested on: CPython 3.12.10 (Fedora 40 system build, standard release
build) and CPython main @ 4c79929
(2026-07-06). No special configuration is needed - a default build of
either version reproduces this.
import sqlite3
class A:
def value(self):
return 1
con = sqlite3.connect(":memory:")
con.create_window_function("f", 1, A)
con.execute("CREATE TABLE t(x)")
con.execute("INSERT INTO t VALUES (1)")
con.execute(
"SELECT f(x) OVER (ROWS BETWEEN 1 PRECEDING AND 1 PRECEDING) FROM t"
).fetchall()Result:
segmentation fault (core dumped) python
No step, inverse, or finalize method needs to be defined on A -
the single row's window frame is unconditionally empty (there is no
row "1 preceding" the only row in the table), so value() is the first
and only callback SQLite invokes.
For a debug build (Py_DEBUG=1, configure --with-pydebug), the
assert(*cls != NULL) fires instead of segfaulting, printing:
Assertion '*cls != NULL' failed in value_callback.
Package: sqlite3 C API.
Affected versions: >= 3.11
CPython versions tested on:
CPython main branch, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
No response
Crash report
What happened?
This issue is a result review security advisories GHSA-g74h-5v93-4q3p.
Summary
Modules/_sqlite/connection.c in the sqlite3 standard library module
dereferences a NULL pointer when a user-defined aggregate window
function's value() (or inverse()) method is invoked by SQLite before
step() has ever been called for that window instance. This happens
whenever the window frame is empty for a given output row (e.g. the
first row of a partition with a frame such as
ROWS BETWEEN 1 PRECEDING AND 1 PRECEDING). On a standard (non-debug)
build, this crashes the whole Python process with SIGSEGV.
The problem in the code was found by the Svace static analyzer (ISP RAS) and
was later confirmed by a real REPL crash.
Details
Tested on: CPython 3.12.10 (Fedora 40 system build, standard release
build) and CPython main @ 4c79929
(2026-07-06). No special configuration is needed - a default build of
either version reproduces this.
Result:
No step, inverse, or finalize method needs to be defined on A -
the single row's window frame is unconditionally empty (there is no
row "1 preceding" the only row in the table), so value() is the first
and only callback SQLite invokes.
For a debug build (Py_DEBUG=1, configure --with-pydebug), the
assert(*cls != NULL) fires instead of segfaulting, printing:
Assertion '*cls != NULL' failed in value_callback.
Package: sqlite3 C API.
Affected versions: >= 3.11
CPython versions tested on:
CPython main branch, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
No response