sqlite: prevent reentrant session.close()

Reject session.close() while generating a changeset or patchset.
Closing the session at that point frees it while SQLite is still
using it, causing a use-after-free.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #65349
Fixes: #65347
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

Author: trivikr

doc/api/sqlite.md

@@ -947,7 +947,8 @@ wrapper around [`sqlite3session_patchset()`][].
 
 ### `session.close()`
 
-Closes the session. An exception is thrown if the database or the session is not open. This method is a
+Closes the session. An exception is thrown if the database or the session is not open,
+or if the session is currently generating a changeset or patchset. This method is a
 wrapper around [`sqlite3session_delete()`][].
 
 ### `session[Symbol.dispose]()`

src/node_sqlite.cc

@@ -3921,6 +3921,10 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
   THROW_AND_RETURN_ON_BAD_STATE(
       env, session->session_ == nullptr, "session is not open");
 
+  session->is_generating_changeset_ = true;
+  auto changeset_guard =
+      OnScopeLeave([&] { session->is_generating_changeset_ = false; });
+
   int nChangeset;
   void* pChangeset;
   int r = sqliteChangesetFunc(session->session_, &nChangeset, &pChangeset);
@@ -3946,6 +3950,8 @@ void Session::Close(const FunctionCallbackInfo<Value>& args) {
       env, !session->database_->IsOpen(), "database is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, session->session_ == nullptr, "session is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, session->is_generating_changeset_, "session is currently in use");
 
   session->Delete();
 }

src/node_sqlite.h

@@ -361,6 +361,7 @@ class Session : public BaseObject {
   void Delete();
   sqlite3_session* session_;
   BaseObjectPtr<DatabaseSync> database_;  // The Parent Database
+  bool is_generating_changeset_ = false;
 
   friend class DatabaseSync;
 };

test/parallel/test-sqlite-session.js

@@ -605,6 +605,28 @@ test('session.close() - closing twice', (t) => {
   });
 });
 
+test('session.close() - while generating changes throws exception', (t) => {
+  for (const method of ['changeset', 'patchset']) {
+    const database = new DatabaseSync(':memory:');
+    database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
+
+    const session = database.createSession({ table: 'data' });
+    database.exec("INSERT INTO data VALUES (1, 'a'), (2, 'b'), (3, 'c')");
+    database.setAuthorizer(() => {
+      session.close();
+      return constants.SQLITE_OK;
+    });
+
+    t.assert.throws(() => session[method](), {
+      code: 'ERR_INVALID_STATE',
+      message: 'session is currently in use',
+    });
+
+    database.setAuthorizer(null);
+    t.assert.notStrictEqual(session[method]().length, 0);
+  }
+});
+
 test('session - keeps its database alive after the db handle is dropped', async (t) => {
   const { gcUntil, onGC } = require('../common/gc');