Use After Free in Fiber with Cockroachdb

Use After Free occurs when a program continues to use a pointer after the memory it references has been deallocated. In a Fiber-based API that uses CockroachDB, this can surface when request-scoped objects (such as context handles, prepared statement references, or row buffers) are accessed after the underlying SQL transaction or connection has been closed or returned to a pool.

Consider a Fiber handler that prepares a CockroachDB statement once and reuses it across requests without ensuring the statement is valid for the lifetime of its usage. If the statement is closed or the transaction ends between preparation and execution, a stale pointer or reference may be retained in the handler’s closure or context. When the handler later attempts to execute or scan into that reference, the program may read or write memory that has already been freed, leading to undefined behavior, crashes, or data corruption.

In distributed systems, this can be triggered by asynchronous flows where a context with deadlines is canceled or times out, but a pending CockroachDB operation still holds references to request-scoped objects. For example, if you pass a pointer to a request-scoped struct containing a CockroachDB Tx or Stmt into a goroutine that outlives the request context, and that goroutine executes after the transaction has been rolled back or committed, the pointer may refer to freed memory.

Another scenario involves improper handling of rows returned by CockroachDB. If you call rows.Next() and then store a reference to row data beyond the call to rows.Close(), or if you cache rows data without copying values into independently managed memory, subsequent access can dereference memory that has been released. This is particularly risky when using connection pooling combined with prepared statements, as the underlying connection and statement lifecycle may be managed by the driver and not directly visible to the application.

Because Fiber is a high-performance web framework with low-latency goals, developers may optimize by reusing objects and contexts across requests. Without explicit lifetime management and strict separation between request scope and database resources, the combination of Fiber’s concurrency model and CockroachDB’s distributed transaction semantics can inadvertently expose use-after-free conditions.

To prevent Use After Free in Fiber applications using CockroachDB, ensure that all database objects such as transactions, statements, and row buffers are valid for the duration of their use and are not referenced after closure or commit/rollback. Below are concrete, safe patterns with real CockroachDB code examples.

1. Avoid reusing prepared statements across requests without re-validation

Prepare statements per-request or use connection-scoped caches that are invalidated on transaction boundaries. Do not store a *sql.Stmt in a Fiber context global or closure that may outlive the transaction.

// Unsafe: reusing a prepared statement across requests without lifecycle control
var globalStmt *sql.Stmt

app.Get("/unsafe", func(c *fiber.Ctx) error {
    if globalStmt == nil {
        stmt, err := db.Prepare("SELECT value FROM kv WHERE key = $1")
        if err != nil {
            return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
        }
        globalStmt = stmt // retained across requests
    }
    var val string
    // Risk: if the transaction or connection state changes, this may become invalid
    err := globalStmt.QueryRow(c.Params("key")).Scan(&val)
    return c.SendString(val)
})

// Safe: prepare and use within the request scope
app.Get("/safe", func(c *fiber.Ctx) error {
    var val string
    err := db.QueryRow("SELECT value FROM kv WHERE key = $1", c.Params("key")).Scan(&val)
    if err != nil {
        return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
    }
    return c.SendString(val)
})

2. Ensure rows are fully consumed and closed before returning from handler

Always iterate to completion and close rows within the same function scope. Do not pass row pointers or slices of row data to goroutines that may execute after rows.Close().

// Unsafe: passing row data to a goroutine that may outlive rows
app.Get("/rows-unsafe", func(c *fiber.Ctx) error {
    rows, err := db.Query("SELECT id, name FROM users WHERE active = $1", true)
    if err != nil {
        return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
    }
    var results []User
    for rows.Next() {
        var u User
        if err := rows.Scan(&u.ID, &u.Name); err != nil {
            rows.Close()
            return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
        }
        results = append(results, u) // data copied, safe
    }
    // Incorrect: passing results to a goroutine that may capture stale references if results contained pointers
    go func(users []User) {
        // Risk if users or its elements referenced rows-managed memory (not the case with value copies, but be cautious)
        _ = users
    }(results)
    rows.Close()
    return c.JSON(results)
})

// Safe: fully consume and close rows within the handler, copy values, and avoid external references
app.Get("/rows-safe", func(c *fiber.Ctx) error {
    rows, err := db.Query("SELECT id, name FROM users WHERE active = $1", true)
    if err != nil {
        return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
    }
    defer rows.Close()
    var results []User
    for rows.Next() {
        var u User
        if err := rows.Scan(&u.ID, &u.Name); err != nil {
            return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
        }
        results = append(results, u)
    }
    if err := rows.Err(); err != nil {
        return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
    }
    return c.JSON(results)
})

3. Use context with timeouts and cancelation safely; avoid referencing canceled contexts

Ensure that database operations respect request context but do not retain references to context-derived objects after the context is canceled. Do not store context or its derived values in long-lived structures.

// Unsafe: storing context-derived values in a global map
var cache = make(map[string]interface{})

app.Get("/context-unsafe", func(c *fiber.Ctx) error {
    key := c.Params("key")
    if v, ok := cache[key]; ok {
        return c.JSON(v)
    }
    var val string
    // Risk: if context is canceled or times out, rows or tx may be tied to it
    ctx, cancel := context.WithTimeout(c.Context(), c.GetReqTimeout())
    defer cancel()
    row := db.QueryRowContext(ctx, "SELECT value FROM kv WHERE key = $1", key)
    if err := row.Scan(&val); err != nil {
        return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
    }
    cache[key] = val // storing value is safe; storing row or tx is not
    return c.JSON(val)
})

// Safe: use context for lifetime control but do not retain references beyond the request
app.Get("/context-safe", func(c *fiber.Ctx) error {
    var val string
    err := c.Context().QueryRow("SELECT value FROM kv WHERE key = $1", c.Params("key")).Scan(&val)
    if err != nil {
        return c.Status(fiber.StatusInternalServerError).SendString(err.Error())
    }
    return c.JSON(val)
})

4. Validate and handle errors from CockroachDB before using returned data

Always check for errors from QueryRow, Query, Exec, and Scan. Do not assume that a non-nil rows object guarantees valid data or that a nil error implies success in the presence of closed connections.

// Safe: full error handling and resource cleanup
app.Get("/validate", func(c *fiber.Ctx) error {
    row := db.QueryRow("SELECT value FROM kv WHERE key = $1", c.Params("key"))
    var val string
    if err := row.Scan(&val); err != nil {
        return c.Status(fiber.StatusBadRequest).SendString("invalid or missing value")
    }
    return c.SendString(val)
})

By following these patterns—scoping preparation and execution to the request lifecycle, properly closing and consuming rows, avoiding retention of database references beyond their valid lifetime, and rigorously checking errors—you can eliminate Use After Free risks when Fiber interacts with CockroachDB.