From 3f86af32f3341bec6edf8e747d78eb61dd88f751 Mon Sep 17 00:00:00 2001
From: Jiseok CHOI <jiseok.dev@gmail.com>
Date: Fri, 27 Feb 2026 21:03:40 +0900
Subject: [PATCH] sqlite3: reject negative fetchmany values (#7240)

---
 Lib/test/test_sqlite3/test_dbapi.py |  1 -
 crates/stdlib/src/_sqlite3.rs       | 13 ++++++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/Lib/test/test_sqlite3/test_dbapi.py b/Lib/test/test_sqlite3/test_dbapi.py
index f78aa7a8e..1f6f76615 100644
--- a/Lib/test/test_sqlite3/test_dbapi.py
+++ b/Lib/test/test_sqlite3/test_dbapi.py
@@ -1125,7 +1125,6 @@ class CursorTests(unittest.TestCase):
         res = self.cu.fetchmany(100)
         self.assertEqual(res, [])
 
-    @unittest.expectedFailure  # TODO: RUSTPYTHON fetchmany size validation not implemented
     def test_invalid_fetchmany(self):
         UINT32_MAX = (1 << 32) - 1
         fetchmany = self.cu.fetchmany
diff --git a/crates/stdlib/src/_sqlite3.rs b/crates/stdlib/src/_sqlite3.rs
index b9e146b98..649831aa3 100644
--- a/crates/stdlib/src/_sqlite3.rs
+++ b/crates/stdlib/src/_sqlite3.rs
@@ -1883,9 +1883,16 @@ mod _sqlite3 {
             args: FetchManyArgs,
             vm: &VirtualMachine,
         ) -> PyResult<Vec<PyObjectRef>> {
-            let max_rows = args
-                .size
-                .unwrap_or_else(|| zelf.arraysize.load(Ordering::Relaxed));
+            let max_rows = match args.size {
+                Some(size) => {
+                    if size < 0 {
+                        return Err(vm.new_value_error("fetchmany may not be negative"));
+                    }
+
+                    size
+                }
+                None => zelf.arraysize.load(Ordering::Relaxed),
+            };
 
             let mut list = vec![];
             while let PyIterReturn::Return(row) = Cursor::next(zelf, vm)? {