sqlite: re-validate database state after reading options

[TrevorBurnham]

Fixes #65586

Several DatabaseSync methods check IsOpen() and then read their options bag with Object::Get(). A user-supplied property getter runs arbitrary JavaScript at that point, so a getter that calls close() invalidates the check before the resulting sqlite3* is used.

function(), aggregate(), deserialize(), applyChangeset(), backup(). All but prepare() all segfault in this scenario. prepare() reports a spurious ERR_SQLITE_ERROR: out of memory instead, because sqlite3_prepare_v3() null-checks its argument.

The fix here is to re-check IsOpen() after option parsing, immediately before the SQLite call. The existing early check is kept: moving it would make attacker-controlled getters run on calls that are already doomed to throw, which is the wrong direction for a hardening change, and would reorder existing error precedence.

createSession() already parsed its options before validating. It gains the matching early check here for consistency.

Two related fixes in the same code:

• deserialize() latched input->ByteLength() before reading options.dbName. A getter that shrinks the backing ArrayBuffer leaves the latched length too large, CopyContents() copies only what remains, its return value is discarded, and the uninitialized remainder is handed to SQLite, where serialize() returns it to JavaScript. The CopyContents() result is now checked.
• function() and aggregate() cast the callback's length with As<Int32>() and no IsInt32() guard. length is configurable, so 'abc', {}, NaN and 1.5 all reached the cast and registered a silently wrong arity. Now validated, matching the five sites in this file that already do.

Verification

New test/parallel/test-sqlite-options-getter-reentry.js covers all seven sites, buffer shrink and detach, and the length type checks.

Compatibility note

Rejecting a non-integer fn.length with ERR_INVALID_ARG_TYPE is a behavior change, though it only affects functions whose length has been redefined.

[nodejs-github-bot]

Review requested:

• @nodejs/sqlite