Skip to content

fix(cpp): out-of-bounds read in delete() when a location is passed#404

Open
pbbadenhorst wants to merge 1 commit into
OP-Engineering:mainfrom
pbbadenhorst:fix/delete-args-index-oob
Open

fix(cpp): out-of-bounds read in delete() when a location is passed#404
pbbadenhorst wants to merge 1 commit into
OP-Engineering:mainfrom
pbbadenhorst:fix/delete-args-index-oob

Conversation

@pbbadenhorst
Copy link
Copy Markdown
Contributor

Summary

The delete JSI host function in cpp/DBHostObject.cpp checks count == 1 for the optional location argument, but then reads args[1] instead of args[0]. Calling db.delete(location) therefore reads past the end of the JSI argument list — undefined behaviour, can crash native code.

Also fixes a stale error string in the same block that referred to [op-sqlite][open] instead of [op-sqlite][delete].

Changes

  • cpp/DBHostObject.cpp: use args[0] for the optional location argument; correct the error message tag.
  • example/src/tests/dbsetup.ts: add two regression tests — one that calls db.delete(location) with a valid string, and one that asserts a non-string argument is rejected by the type guard.

@oscar-opacity
Copy link
Copy Markdown

err, no, there is some error there, but the delete function was meant to replicate the same behavior as open where you could pass a base path + name of the db as separate arguments. It's a broken artifact of the many migrations over the years. I will take a look later.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants