Skip to content

Commit 4373e55

Browse files
committed
sqlite: fix use-after-free in StatementSync due to premature GC
1 parent db7a31e commit 4373e55

File tree

2 files changed

+10
-11
lines changed

2 files changed

+10
-11
lines changed

src/node_sqlite.cc

+7-8
Original file line numberDiff line numberDiff line change
@@ -511,7 +511,8 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
511511
sqlite3_stmt* s = nullptr;
512512
int r = sqlite3_prepare_v2(db->connection_, *sql, -1, &s, 0);
513513
CHECK_ERROR_OR_THROW(env->isolate(), db->connection_, r, SQLITE_OK, void());
514-
BaseObjectPtr<StatementSync> stmt = StatementSync::Create(env, db, s);
514+
BaseObjectPtr<StatementSync> stmt =
515+
StatementSync::Create(env, BaseObjectPtr<DatabaseSync>(db), s);
515516
db->statements_.insert(stmt.get());
516517
args.GetReturnValue().Set(stmt->object());
517518
}
@@ -923,11 +924,10 @@ void DatabaseSync::LoadExtension(const FunctionCallbackInfo<Value>& args) {
923924

924925
StatementSync::StatementSync(Environment* env,
925926
Local<Object> object,
926-
DatabaseSync* db,
927+
BaseObjectPtr<DatabaseSync> db,
927928
sqlite3_stmt* stmt)
928-
: BaseObject(env, object) {
929+
: BaseObject(env, object), db_(std::move(db)) {
929930
MakeWeak();
930-
db_ = db;
931931
statement_ = stmt;
932932
// In the future, some of these options could be set at the database
933933
// connection level and inherited by statements to reduce boilerplate.
@@ -1580,9 +1580,8 @@ Local<FunctionTemplate> StatementSync::GetConstructorTemplate(
15801580
return tmpl;
15811581
}
15821582

1583-
BaseObjectPtr<StatementSync> StatementSync::Create(Environment* env,
1584-
DatabaseSync* db,
1585-
sqlite3_stmt* stmt) {
1583+
BaseObjectPtr<StatementSync> StatementSync::Create(
1584+
Environment* env, BaseObjectPtr<DatabaseSync> db, sqlite3_stmt* stmt) {
15861585
Local<Object> obj;
15871586
if (!GetConstructorTemplate(env)
15881587
->InstanceTemplate()
@@ -1591,7 +1590,7 @@ BaseObjectPtr<StatementSync> StatementSync::Create(Environment* env,
15911590
return BaseObjectPtr<StatementSync>();
15921591
}
15931592

1594-
return MakeBaseObject<StatementSync>(env, obj, db, stmt);
1593+
return MakeBaseObject<StatementSync>(env, obj, std::move(db), stmt);
15951594
}
15961595

15971596
Session::Session(Environment* env,

src/node_sqlite.h

+3-3
Original file line numberDiff line numberDiff line change
@@ -91,13 +91,13 @@ class StatementSync : public BaseObject {
9191
public:
9292
StatementSync(Environment* env,
9393
v8::Local<v8::Object> object,
94-
DatabaseSync* db,
94+
BaseObjectPtr<DatabaseSync> db,
9595
sqlite3_stmt* stmt);
9696
void MemoryInfo(MemoryTracker* tracker) const override;
9797
static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
9898
Environment* env);
9999
static BaseObjectPtr<StatementSync> Create(Environment* env,
100-
DatabaseSync* db,
100+
BaseObjectPtr<DatabaseSync> db,
101101
sqlite3_stmt* stmt);
102102
static void All(const v8::FunctionCallbackInfo<v8::Value>& args);
103103
static void Iterate(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -117,7 +117,7 @@ class StatementSync : public BaseObject {
117117

118118
private:
119119
~StatementSync() override;
120-
DatabaseSync* db_;
120+
BaseObjectPtr<DatabaseSync> db_;
121121
sqlite3_stmt* statement_;
122122
bool use_big_ints_;
123123
bool allow_bare_named_params_;

0 commit comments

Comments
 (0)