Skip to content

Commit 870f499

Browse files
mcollinaaduh95
authored andcommitted
sqlite: fix use-after-free in Exec() and ApplyChangeset()
When sqlite3_exec() or sqlite3changeset_apply() call JavaScript callbacks (user-defined functions, conflict handlers, or filter callbacks), the DatabaseSync object could be garbage-collected if the JavaScript code drops all references to it. Both methods only held a raw DatabaseSync* pointer on the C++ stack, which V8 GC does not track. Add a BaseObjectPtr<DatabaseSync> guard that keeps the database alive for the duration of these SQLite API calls, preventing a use-after-free when the JavaScript callback triggers GC. Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #64535 Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
1 parent ca60942 commit 870f499

1 file changed

Lines changed: 14 additions & 0 deletions

File tree