Commit f912692
sqlite: fix use-after-free in Exec() and ApplyChangeset()
When sqlite3_exec() or sqlite3changeset_apply() call JavaScript
callbacks (user-defined functions, conflict handlers, or filter
callbacks), the DatabaseSync object could be garbage-collected
if the JavaScript code drops all references to it. Both methods
only held a raw DatabaseSync* pointer on the C++ stack, which
V8 GC does not track.
Add a BaseObjectPtr<DatabaseSync> guard that keeps the database
alive for the duration of these SQLite API calls, preventing a
use-after-free when the JavaScript callback triggers GC.
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #64535
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>1 parent 6d60fce commit f912692
1 file changed
Lines changed: 14 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1584,6 +1584,13 @@ void DatabaseSync::Exec(const FunctionCallbackInfo<Value>& args) { | |||
| 1584 | 1584 | return; | |
| 1585 | 1585 | } | |
| 1586 | 1586 | ||
| 1587 | + // Keep the database alive during sqlite3_exec(), which may call | ||
| 1588 | + // user-defined SQLite functions that trigger JavaScript callbacks. | ||
| 1589 | + // If the JavaScript callback drops all references to the database, | ||
| 1590 | + // the DatabaseSync could otherwise be garbage-collected while the | ||
| 1591 | + // SQLite callback is still executing, causing a use-after-free. | ||
| 1592 | + BaseObjectPtr<DatabaseSync> guard(db); | ||
| 1593 | + | ||
| 1587 | 1594 | Utf8Value sql(env->isolate(), args[0].As<String>()); | |
| 1588 | 1595 | int r = sqlite3_exec(db->connection_, *sql, nullptr, nullptr, nullptr); | |
| 1589 | 1596 | CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void()); | |
@@ -2358,6 +2365,13 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) { | |||
| 2358 | 2365 | } | |
| 2359 | 2366 | } | |
| 2360 | 2367 | ||
| 2368 | + // Keep the database alive during sqlite3changeset_apply(), which may | ||
| 2369 | + // call conflict or filter callbacks that trigger JavaScript execution. | ||
| 2370 | + // If the JavaScript callback drops all references to the database, | ||
| 2371 | + // the DatabaseSync could otherwise be garbage-collected while the | ||
| 2372 | + // callback is still executing, causing a use-after-free. | ||
| 2373 | + BaseObjectPtr<DatabaseSync> guard(db); | ||
| 2374 | + | ||
| 2361 | 2375 | ArrayBufferViewContents<uint8_t> buf(args[0]); | |
| 2362 | 2376 | int r = sqlite3changeset_apply( | |
| 2363 | 2377 | db->connection_, | |
0 commit comments