Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sqlite: fix use-after-free in StatementSync due to premature GC #56840

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

littledivy
Copy link
Member

This patch updates StatementSync to store a strong reference to the database base object.

DatabaseSync may be garbage collected and freed while StatementSync is using it (due to MakeWeak()). The following code crashes with a segmentation fault:

import { DatabaseSync } from "node:sqlite";

const db = new DatabaseSync(':memory:');
db.exec('CREATE TABLE test (value INTEGER)');

const stmt = db.prepare('INSERT INTO test VALUES (?)');

for(;;) stmt.run(0);
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x38)
    frame #0: 0x000000010036e358 node`node::sqlite::StatementSync::Run(v8::FunctionCallbackInfo<v8::Value> const&) + 432
node`node::sqlite::StatementSync::Run:
->  0x10036e358 <+432>: ldr    x1, [x8, #0x38]
    0x10036e35c <+436>: ldr    x22, [x8, #0x78]
    0x10036e360 <+440>: ldrb   w8, [x19, #0x40]
    0x10036e364 <+444>: ldr    x24, [x25, #0xa8]

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem. labels Jan 31, 2025
Copy link
Contributor

@cjihrig cjihrig left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@cjihrig cjihrig added the request-ci Add this label to start a Jenkins CI on a PR. label Jan 31, 2025
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jan 31, 2025
@nodejs-github-bot
Copy link
Collaborator

Copy link

codecov bot commented Jan 31, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.20%. Comparing base (db7a31e) to head (4373e55).
Report is 165 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff            @@
##             main   #56840    +/-   ##
========================================
  Coverage   89.19%   89.20%            
========================================
  Files         662      663     +1     
  Lines      191794   192011   +217     
  Branches    36927    36930     +3     
========================================
+ Hits       171076   171274   +198     
- Misses      13568    13608    +40     
+ Partials     7150     7129    -21     
Files with missing lines Coverage Δ
src/node_sqlite.cc 79.63% <100.00%> (-0.02%) ⬇️
src/node_sqlite.h 70.00% <ø> (ø)

... and 95 files with indirect coverage changes

@cjihrig cjihrig added the request-ci Add this label to start a Jenkins CI on a PR. label Jan 31, 2025
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jan 31, 2025
@nodejs-github-bot
Copy link
Collaborator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants