sqlite: prevent reentrant statement finalization

Track statement execution depth while calling sqlite3_step(). Reject
close() and deserialize() while a statement is executing so callbacks
cannot finalize the active statement and crash.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol

Author: trivikr

src/node_sqlite.cc

@@ -1063,6 +1063,12 @@ void DatabaseSync::UntrackStatement(StatementSync* statement) {
   }
 }
 
+int DatabaseSync::Step(sqlite3_stmt* statement) {
+  statement_execution_depth_++;
+  auto leave = OnScopeLeave([&]() { statement_execution_depth_--; });
+  return sqlite3_step(statement);
+}
+
 inline bool DatabaseSync::IsOpen() {
   return connection_ != nullptr;
 }
@@ -1456,6 +1462,10 @@ void DatabaseSync::Close(const FunctionCallbackInfo<Value>& args) {
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, db->IsInCallback(), "database cannot be closed while in a callback");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env,
+      db->statement_execution_depth_ != 0,
+      "cannot close database while a statement is executing");
   db->FinalizeStatements();
   db->DeleteSessions();
   int r = sqlite3_close_v2(db->connection_);
@@ -1851,6 +1861,10 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env,
+      db->statement_execution_depth_ != 0,
+      "cannot deserialize while a statement is executing");
 
   if (!args[0]->IsUint8Array()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2925,7 +2939,7 @@ MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
   LocalVector<Value> row_values(isolate);
   LocalVector<Name> row_keys(isolate);
 
-  while ((r = sqlite3_step(stmt)) == SQLITE_ROW) {
+  while ((r = db->Step(stmt)) == SQLITE_ROW) {
     if (num_cols == 0) {
       num_cols = sqlite3_column_count(stmt);
     }
@@ -2967,7 +2981,7 @@ MaybeLocal<Object> StatementExecutionHelper::Run(Environment* env,
                                                  bool use_big_ints) {
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
-  sqlite3_step(stmt);
+  db->Step(stmt);
   int r = sqlite3_reset(stmt);
   CHECK_ERROR_OR_THROW(isolate, db, r, SQLITE_OK, MaybeLocal<Object>());
 
@@ -3045,7 +3059,7 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
   EscapableHandleScope scope(isolate);
   auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt); });
 
-  int r = sqlite3_step(stmt);
+  int r = db->Step(stmt);
   if (r == SQLITE_DONE) return scope.Escape(Undefined(isolate));
   if (r != SQLITE_ROW) {
     THROW_ERR_SQLITE_ERROR(isolate, db);
@@ -3772,7 +3786,7 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
       iter->statement_reset_generation_ != iter->stmt_->reset_generation_,
       "iterator was invalidated");
 
-  int r = sqlite3_step(iter->stmt_->statement_);
+  int r = iter->stmt_->db_->Step(iter->stmt_->statement_);
   if (r != SQLITE_ROW) {
     CHECK_ERROR_OR_THROW(
         env->isolate(), iter->stmt_->db_.get(), r, SQLITE_DONE, void());

src/node_sqlite.h

@@ -239,6 +239,7 @@ class DatabaseSync : public BaseObject {
  private:
   bool Open();
   void DeleteSessions();
+  int Step(sqlite3_stmt* statement);
 
   ~DatabaseSync() override;
   DatabaseOpenConfiguration open_config_;
@@ -247,6 +248,7 @@ class DatabaseSync : public BaseObject {
   sqlite3* connection_;
   bool ignore_next_sqlite_error_;
   int callback_depth_ = 0;
+  uint32_t statement_execution_depth_ = 0;
 
   std::set<BackupJob*> backups_;
   std::unordered_set<Session*> sessions_;
@@ -256,6 +258,7 @@ class DatabaseSync : public BaseObject {
   friend class Session;
   friend class SQLTagStore;
   friend class StatementExecutionHelper;
+  friend class StatementSyncIterator;
 };
 
 class StatementSync : public BaseObject {

test/parallel/test-sqlite-custom-functions.js

@@ -6,6 +6,19 @@ const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
 
 suite('DatabaseSync.prototype.function()', () => {
+  test('cannot close the database while a statement is executing', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.after(() => db.close());
+    db.function('close_database', () => db.close());
+    const stmt = db.prepare('SELECT close_database()');
+
+    t.assert.throws(() => stmt.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: 'cannot close database while a statement is executing',
+    });
+    t.assert.strictEqual(db.isOpen, true);
+  });
+
   suite('input validation', () => {
     const db = new DatabaseSync(':memory:');
 

test/parallel/test-sqlite-serialize.js

@@ -82,6 +82,23 @@ suite('DatabaseSync.prototype.serialize()', () => {
 });
 
 suite('DatabaseSync.prototype.deserialize()', () => {
+  test('cannot deserialize while a statement is executing', (t) => {
+    const source = new DatabaseSync(':memory:');
+    const serialized = source.serialize();
+    source.close();
+
+    const db = new DatabaseSync(':memory:');
+    t.after(() => db.close());
+    db.function('deserialize_database', () => db.deserialize(serialized));
+    const stmt = db.prepare('SELECT deserialize_database()');
+
+    t.assert.throws(() => stmt.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: 'cannot deserialize while a statement is executing',
+    });
+    t.assert.strictEqual(db.isOpen, true);
+  });
+
   test('loads a serialized database', (t) => {
     const db1 = new DatabaseSync(':memory:');
     db1.exec('CREATE TABLE t(id INTEGER PRIMARY KEY, name TEXT)');