sqlite: throw on oversized error messages

SQLite error messages embed the offending identifier or token, so they
can exceed String::kMaxLength. CreateSQLiteErrorImpl() converted them
with String::NewFromUtf8() and the default length of -1, which skips
V8's length check and aborts the process.

Convert the message with Utf8StringMaybeOneByte() so an oversized
message throws ERR_STRING_TOO_LONG instead.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5

Author: trivikr

src/node_sqlite.cc

@@ -284,7 +284,9 @@ MaybeLocal<Object> CreateSQLiteErrorImpl(Isolate* isolate,
   Local<Context> context = isolate->GetCurrentContext();
   Local<String> js_msg;
   Local<Object> e;
-  if (!String::NewFromUtf8(isolate, message).ToLocal(&js_msg) ||
+  // SQLite error messages embed the offending identifier or token, so they
+  // can exceed String::kMaxLength.
+  if (!Utf8StringMaybeOneByte(isolate, message).ToLocal(&js_msg) ||
       !Exception::Error(js_msg)->ToObject(context).ToLocal(&e) ||
       e->Set(context, env->code_string(), env->err_sqlite_error_string())
           .IsNothing()) {

test/parallel/test-sqlite-statement.js

@@ -1458,6 +1458,15 @@ suite('values larger than the maximum string length', { skip: !enoughTestMem },
     }, tooLong);
   });
 
+  test('prepare() throws when the SQLite error message is too long', (t) => {
+    using db = new Database(':memory:');
+    // '\u20ac' is 3 bytes in UTF-8, and SQLite repeats the name in the error.
+    const name = '\u20ac'.repeat(Math.ceil(constants.MAX_STRING_LENGTH / 3) + 10);
+    t.assert.throws(() => {
+      db.prepare(`SELECT 1 FROM "${name}"`);
+    }, tooLong);
+  });
+
   test('exec() surfaces the error from a user-defined function', (t) => {
     using db = new Database(':memory:');
     db.exec('CREATE TABLE data(val TEXT)');