sqlite3 Cursor NULL-deref via reentrant execute() inside a text_factory/converter during fetch

Bug report

Bug description:

import sqlite3
con = sqlite3.connect(":memory:")
con.execute("CREATE TABLE t(a TEXT, b TEXT)")
con.execute("INSERT INTO t VALUES ('first', 'second')")
cur = con.cursor()
def btf(data):
    try:
        cur.execute("SELECT 1")            
    except sqlite3.ProgrammingError:
        pass                              
    return bytes(data).decode()
con.text_factory = btf
cur.execute("SELECT a, b FROM t")
print(cur.fetchone())                  

Modules/_sqlite/cursor.c:402:23: runtime error: member access within null pointer of type 'struct pysqlite_Statement'
    #0 _pysqlite_fetch_one_row Modules/_sqlite/cursor.c:402
    #1 pysqlite_cursor_iternext Modules/_sqlite/cursor.c:1155
    #2 pysqlite_cursor_fetchone_impl Modules/_sqlite/cursor.c:1206
    #3 pysqlite_cursor_fetchone Modules/_sqlite/clinic/cursor.c.h:169

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-157578

從 Modules/_sqlite/cursor.c 開始，尤其是 402 行附近的 _pysqlite_fetch_one_row，並使用所示的 text_factory 回呼在 sanitizer 下重現該報告。追蹤可重入的 cur.execute() 如何在擷取過程中影響該陳述式；完成的標準是重現器不再觸發空指標解參照，並在現有的關聯工作旁新增適當的涵蓋率。