Skip to content

fix(native): keep the live handle when open is called on an open db - #1485

Open
dxbjavid wants to merge 1 commit into
xerial:masterfrom
dxbjavid:open-already-open-uaf
Open

dxbjavid wants to merge 1 commit into
xerial:masterfrom
dxbjavid:open-already-open-uaf

Conversation

@dxbjavid

Copy link
Copy Markdown
Contributor

Calling open on a NativeDB that is already open makes _open_utf8 throw "DB already open" and then close the existing sqlite3 handle, but the freed pointer is left behind in NativeDB.pointer, so later calls on that connection touch freed memory; in practice the next connection opened tends to reuse the same allocation, and closing the first connection then closes the second one's database and leaves it on a dangling handle. The fix only throws on that path and leaves the open connection as it was, so it stays usable and is closed normally later, and the new test in ConnectionTest fails with SQLITE_MISUSE without it.

@gotson

gotson commented Oct 22, 2026

Copy link
Copy Markdown
Collaborator

Hi, CI is failing on the newly added test.

@dxbjavid

Copy link
Copy Markdown
Contributor Author

That failure is the bug itself rather than a problem with the test. The regular jobs run against the prebuilt binaries checked into src/main/resources, which still have the sqlite3_close on the already-open path, so the statement after the rejected open lands on the freed handle and comes back with SQLITE_MISUSE, which is exactly what the test is there to catch. The one job that compiles the native library from source (test external amalgamation) passes the full suite including this test, and the change in NativeDB.c only takes effect once the native libs are rebuilt.

I tried to run the Build Native workflow on my fork to push rebuilt libraries to the branch, but Actions can't be switched on for the fork from my side. If you can run Build Native against this branch the test should go green; otherwise I can rebuild and push the libraries myself, or drop the test if you'd rather keep the PR to the C change.

@gotson

gotson commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

thanks for the clarification

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants