bpo-43249: sqlite3_column_bytes() must follow sqlite_column_blob() (GH-24562)

diff --git a/Modules/_sqlite/cursor.c b/Modules/_sqlite/cursor.c
index f8fe11ed1ea75b9f2648f6d20e682c0971fbac06..63176b81b10efb72e795087df2d984b07eaf2b0a 100644 (file)
--- a/Modules/_sqlite/cursor.c
+++ b/Modules/_sqlite/cursor.c
@@ -278,9 +278,15 @@ _pysqlite_fetch_one_row(pysqlite_Cursor* self)
             converter = Py_None;
         }
 
+        /*
+         * Note, sqlite3_column_bytes() must come after sqlite3_column_blob()
+         * or sqlite3_column_text().
+         *
+         * See https://sqlite.org/c3ref/column_blob.html for details.
+         */
         if (converter != Py_None) {
-            nbytes = sqlite3_column_bytes(self->statement->st, i);
             val_str = (const char*)sqlite3_column_blob(self->statement->st, i);
+            nbytes = sqlite3_column_bytes(self->statement->st, i);
             if (!val_str) {
                 converted = Py_NewRef(Py_None);
             } else {
@@ -330,9 +336,13 @@ _pysqlite_fetch_one_row(pysqlite_Cursor* self)
                 }
             } else {
                 /* coltype == SQLITE_BLOB */
-                nbytes = sqlite3_column_bytes(self->statement->st, i);
-                converted = PyBytes_FromStringAndSize(
-                    sqlite3_column_blob(self->statement->st, i), nbytes);
+                const char *blob = sqlite3_column_blob(self->statement->st, i);
+                if (!blob) {
+                    converted = Py_NewRef(Py_None);
+                } else {
+                    nbytes = sqlite3_column_bytes(self->statement->st, i);
+                    converted = PyBytes_FromStringAndSize(blob, nbytes);
+                }
             }
         }