Description

ever0de

opened on May 26, 2026

Issue body actions

What happened?

sqlite3.Blob crashes when you use a negative step in a slice — both for reading and writing.
The sequence operations docs say s[i:j:k] with negative k is valid, and bytearray handles it fine.

import sqlite3

con = sqlite3.connect(":memory:")
con.execute("CREATE TABLE t(b BLOB)")
data = b"this blob data string is exactly fifty bytes long!"
con.execute("INSERT INTO t(b) VALUES (?)", (data,))

# bytearray works
ba = bytearray(data)
ba[9:0:-2] = b"12345"
print(ba)
# b't5i4 3l2b1data string is exactly fifty bytes long!'

# Blob crashes
blob = con.blobopen("t", "b", 1)
blob[9:0:-2] = b"12345"
blob.close()

>>> blob[9:0:-2] = b"12345"
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
SystemError: Negative size passed to PyBytes_FromStringAndSize

Reading also crashes: blob[9:0:-2] raises the same error.

On Python 3.11.6 and 3.14.5 the error is SystemError: Negative size passed to PyBytes_FromStringAndSize.
On the current main branch read_multiple was changed to use PyBytesWriter_Create, so the message is now ValueError: size must be >= 0 — but the root cause is the same.

CPython versions tested on:

3.11.6, 3.14.5, main(629da5c)

Operating systems tested on:

macOS - 26.3.1 (a)(25D771280a)

---

Related

• assertion failure at Modules/_sqlite/blob.c:146: PyObject *read_multiple(pysqlite_Blob *, Py_ssize_t, Py_ssize_t): Assertion 'offset < sqlite3_blob_bytes(self->blob)' failed #142787 / gh-142787: Fix assertion failure in sqlite3 blob slice #142824 — different bug (assertion failure on empty slice, already fixed)
• https://docs.python.org/3/library/stdtypes.html#typesseq-common (s[i:j:k], negative k)

---

I'd like to work on a fix for this. I'll submit a PR.

Linked PRs

• gh-150449: Fix sqlite3.Blob crash with negative-step slices #150450
• [3.15] gh-150449: Raise ValueError for sqlite3.Blob slices with a negative step #155773
• [3.14] gh-150449: Raise ValueError for sqlite3.Blob slices with a negative step (GH-155773) #159110

Activity

1. ever0de

   added a commit that references this issue on May 26, 2026

   pythongh-150449: Fix sqlite3.Blob crash with negative-step slices

   24ade8a
2. picnixz

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   topic-sqlite3

   on May 26, 2026
3. github-project-automation

   added this to sqlite3 issueson May 26, 2026
4. ever0de

   added 3 commits that reference this issue on May 26, 2026

   pythongh-150449: Fix sqlite3.Blob crash with negative-step slices

   af0eb65

   pythongh-150449: validate slice assignment size even for empty slices

   85312b4

   pythongh-150449: add tests for negative-step slices with start <= stop

   c0c2018
5. serhiy-storchaka commented on May 29, 2026

   

   serhiy-storchaka

   on May 29, 2026

   Member

   More actions

   Not all sequences support extended slices (with step), especially with step < 0. Does it currently work with positive step? Supporting step < 0 is a new feature, this change can only go in main.

   But crash and SystemError are unacceptable. In older versions we need to raise a TypeError or a ValueError for step < 0.
6. ever0de commented on May 30, 2026

   

   ever0de

   on May 30, 2026

   ContributorAuthor

   More actions

   Not all sequences support extended slices (with step), especially with step < 0. Does it currently work with positive step? Supporting step < 0 is a new feature, this change can only go in main.

   Yes, positive steps already work.

   Test results on Python 3.13.4:

   blob[0:10:2] = [0, 2, 4, 6, 8]
   blob[0:15:3] = [0, 3, 6, 9, 12]
   blob[1:10:2] = [1, 3, 5, 7, 9]
   after write blob[0:10:2] = [65, 66, 67, 68, 69]
   blob[9:0:-2] raises SystemError: Negative size passed to PyBytes_FromStringAndSize
   

   The Python data model notes that step support is optional:

   Some sequences also support “extended slicing” with a third “step” parameter
   Data Model §3.2.5 Sequences

   Since positive steps already work, I was wondering: once a type accepts a step argument at all, should it handle both positive and negative steps? Or is step < 0 still considered a separate addition?

   Either way, I'll prepare backport PRs that raise ValueError for step < 0 in 3.13, 3.14 and 3.15.

   https://devguide.python.org/versions/
7. ever0de

   added 5 commits that reference this issue on May 30, 2026

   pythongh-150449: Address review: docs, tests, and rename write_offset

   f7c9f53

   pythongh-150449: Fix versionchanged version: use 'next' not '3.16'

   5087b42

   pythongh-150449: Fix wording in NEWS and whatsnew: 'crash' → 'raise S…

   d774ab7

   pythongh-150449: Remove redundant issue references from test comments

   5bf02de

   Merge remote-tracking branch 'upstream/main' into pythongh-150449-fix…

   c311c8e
8. 11 remaining items
9. serhiy-storchaka

   added a commit that references this issue on Jun 8, 2026

   Merge branch 'main' into pythongh-150449-fix-sqlite-blob-negative-ste…

   a462e70
10. serhiy-storchaka

    added 4 commits that reference this issue on Aug 11, 2026

    Merge branch 'main' into pythongh-150449-fix-sqlite-blob-negative-ste…

    d6e07f5

    Merge branch 'main' into pythongh-150449-fix-sqlite-blob-negative-ste…

    98fc681

    Merge branch 'main' into pythongh-150449-fix-sqlite-blob-negative-ste…

    c587f21

    gh-150449: Support negative steps in sqlite3.Blob slices (GH-150450)

    c72ea53
11. serhiy-storchaka

    added

    3.13only security fixesonly security fixes

    3.14bugs and security fixesbugs and security fixes

    3.15bugs and security fixesbugs and security fixes

    3.16new features, bugs and security fixesnew features, bugs and security fixes

    type-featureA feature request or enhancementA feature request or enhancement

    on Aug 14, 2026
12. serhiy-storchaka commented on Aug 14, 2026

    

    serhiy-storchaka

    on Aug 14, 2026

    Member

    More actions

    So, 3.16 got a correct support for negative indices, 3.13-3.15 will get a bugfix.

    Reacted by Jiseok CHOI
13. mbeijen

    added a commit that references this issue on Aug 14, 2026

    pythongh-150449: Support negative steps in sqlite3.Blob slices (pytho…

    b940ed2
14. serhiy-storchaka

    added 2 commits that reference this issue on Oct 9, 2026

    [3.15] gh-150449: Raise ValueError for sqlite3.Blob slices with a neg…

    503560d

    [3.14] gh-150449: Raise ValueError for sqlite3.Blob slices with a neg…

    15045f4
15. StanFromIreland

    closed this as completedon Oct 11, 2026

Issue actions