Security context

Highlights

Buffer Overflow: 1 prior fix. Scrutinize any change in this area.

src/main/java/org/sqlite/core: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Use After Free: Concurrent executions and finalizations of raw SQLite prepared statements can lead to use-after-free vulnerabilities. Race conditions allow one thread to free a native pointer via sqlite3_finalize while another thread is executing step or fetching metadata, corrupting native memory. These operations must be mediated by a thread-safe wrapper like SafeStmtPtr.

Buffer Overflow: When registering custom SQLite functions or collations via JNI, validating strings using Java's string length instead of their UTF-8 byte length can result in buffer overflows in the native C layer when converting names to UTF-8. Length validation must occur post-conversion using the actual UTF-8 byte representation.