Skip to content

Commit d6bbf57

Browse files
trivikrtrivikr
authored
sqlite: prevent reentrant session.close()
Reject session.close() while generating a changeset or patchset. Closing the session at that point frees it while SQLite is still using it, causing a use-after-free. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: codex:gpt-5.6-sol PR-URL: #65349 Fixes: #65347 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
1 parent 882a781 commit d6bbf57

4 files changed

Lines changed: 31 additions & 1 deletion

File tree

‎doc/api/sqlite.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1013,7 +1013,8 @@ wrapper around [`sqlite3session_patchset()`][].
10131013

10141014
### `session.close()`
10151015

1016-
Closes the session. An exception is thrown if the database or the session is not open. This method is a
1016+
Closes the session. An exception is thrown if the database or the session is not open,
1017+
or if the session is currently generating a changeset or patchset. This method is a
10171018
wrapper around [`sqlite3session_delete()`][].
10181019

10191020
### `session[Symbol.dispose]()`

‎src/node_sqlite.cc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4299,6 +4299,10 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
42994299
env, session->session_ == nullptr, "session is not open");
43004300
THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
43014301

4302+
session->is_generating_changeset_ = true;
4303+
auto changeset_guard =
4304+
OnScopeLeave([&] { session->is_generating_changeset_ = false; });
4305+
43024306
int nChangeset;
43034307
void* pChangeset;
43044308
int r = sqliteChangesetFunc(session->session_, &nChangeset, &pChangeset);
@@ -4324,6 +4328,8 @@ void Session::Close(const FunctionCallbackInfo<Value>& args) {
43244328
env, !session->database_->IsOpen(), "database is not open");
43254329
THROW_AND_RETURN_ON_BAD_STATE(
43264330
env, session->session_ == nullptr, "session is not open");
4331+
THROW_AND_RETURN_ON_BAD_STATE(
4332+
env, session->is_generating_changeset_, "session is currently in use");
43274333

43284334
session->Delete();
43294335
}

‎src/node_sqlite.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -458,6 +458,7 @@ class Session : public BaseObject {
458458
void Delete();
459459
sqlite3_session* session_;
460460
BaseObjectPtr<DatabaseSync> database_; // The Parent Database
461+
bool is_generating_changeset_ = false;
461462

462463
friend class DatabaseSync;
463464
};

‎test/parallel/test-sqlite-session.js‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -612,6 +612,28 @@ test('session.close() - closing twice', (t) => {
612612
});
613613
});
614614

615+
test('session.close() - while generating changes throws exception', (t) => {
616+
for (const method of ['changeset', 'patchset']) {
617+
const database = new DatabaseSync(':memory:');
618+
database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
619+
620+
const session = database.createSession({ table: 'data' });
621+
database.exec("INSERT INTO data VALUES (1, 'a'), (2, 'b'), (3, 'c')");
622+
database.setAuthorizer(() => {
623+
session.close();
624+
return constants.SQLITE_OK;
625+
});
626+
627+
t.assert.throws(() => session[method](), {
628+
code: 'ERR_INVALID_STATE',
629+
message: 'session is currently in use',
630+
});
631+
632+
database.setAuthorizer(null);
633+
t.assert.notStrictEqual(session[method]().length, 0);
634+
}
635+
});
636+
615637
test('session - keeps its database alive after the db handle is dropped', async (t) => {
616638
const { gcUntil, onGC } = require('../common/gc');
617639

0 commit comments

Comments
 (0)