From 86396b740aaf003c6cc048f4619e4519f41b9c62 Mon Sep 17 00:00:00 2001 From: Jelle Zijlstra Date: Thu, 22 Oct 2026 14:50:43 -0700 Subject: [PATCH] gh-159739: Keep SQLite list parameters alive while binding (GH-160192) When a SQL parameter sequence is an exact list, sqlite3 retrieved an element as a borrowed reference before taking ownership. On free-threaded builds another thread can replace it in between, so binding can use a freed object and crash. Fetch a strong reference atomically. Backport to 3.15 and 3.14. (cherry picked from commit 4df47d8e60020f8961cab2be1ea7267bf16fd128) Co-authored-by: Jelle Zijlstra --- .../Library/2026-10-21-21-26-10.gh-issue-159739.JIqZRY.rst | 1 + Modules/_sqlite/cursor.c | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Library/2026-10-21-21-26-10.gh-issue-159739.JIqZRY.rst diff --git a/Misc/NEWS.d/next/Library/2026-10-21-21-26-10.gh-issue-159739.JIqZRY.rst b/Misc/NEWS.d/next/Library/2026-10-21-21-26-10.gh-issue-159739.JIqZRY.rst new file mode 100644 index 000000000000000..fa000802ef713bf --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-21-21-26-10.gh-issue-159739.JIqZRY.rst @@ -0,0 +1 @@ +Fix a possible crash when a list of :mod:`sqlite3` parameters is modified concurrently on a free-threaded build. diff --git a/Modules/_sqlite/cursor.c b/Modules/_sqlite/cursor.c index 4e6f46261b10bc6..04b22f113b2b64d 100644 --- a/Modules/_sqlite/cursor.c +++ b/Modules/_sqlite/cursor.c @@ -686,8 +686,7 @@ bind_parameters(pysqlite_state *state, pysqlite_Statement *self, PyObject *item = PyTuple_GET_ITEM(parameters, i); current_param = Py_NewRef(item); } else if (PyList_CheckExact(parameters)) { - PyObject *item = PyList_GetItem(parameters, i); - current_param = Py_XNewRef(item); + current_param = PyList_GetItemRef(parameters, i); } else { current_param = PySequence_GetItem(parameters, i); }