sqlite: binding a zero-length Uint8Array to a parameter can result in NULL #67188

Version

v22.23.4

Platform

Linux redacted 7.0.0-38-generic #38~24.04.4-Ubuntu SMP PREEMPT_DYNAMIC Mon Sep 14 16:37:11 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

sqlite

What steps will reproduce the bug?

const { DatabaseSync } = require('node:sqlite');
const db = new DatabaseSync(':memory:');

// Expected: prints { type: 'blob' }
console.log(db.prepare('SELECT typeof(?) AS type').get(new Uint8Array()));

// Unexpected: prints { type: 'null' }
console.log(db.prepare('SELECT typeof(?) AS type').get(new Uint8Array(new ArrayBuffer(0))));

How often does it reproduce? Is there a required condition?

The above code seems to reproduce the issue deterministically.

What is the expected behavior? Why is that the expected behavior?

All zero-length Uint8Arrays bound to SQLite parameters should be converted to empty blobs.

What do you see instead?

new Uint8Array(new ArrayBuffer(0)) is converted to NULL.

Additional information

This seems to be fixed in v24 and v26.

My agent (GPT-6.1 Sol on Codex CLI) told me the following:

Reproduced on Node.js v22.23.4. ArrayBufferViewContents returns a non-null stack pointer for new Uint8Array(), but a null backing-store pointer for new Uint8Array(new ArrayBuffer(0)). Node passes that pointer to SQLite, which interprets null pointers as SQL NULL, regardless of length.

v26 includes commit bdf75a6 (PR #62343), which makes the helper fall back to stack storage when the backing-store pointer is null. This fixes the SQLite behavior indirectly; the change originally addressed a crypto bug. Backporting this helper fix would resolve the v22 reproducer.