Re: psqlodbc.dll crash

----- Original Message -----
From: "Tambet Matiisen" <t(dot)matiisen(at)aprote(dot)ee>
To: <pgsql-odbc(at)postgresql(dot)org>
Sent: Friday, January 31, 2003 11:39 AM
Subject: [ODBC] psqlodbc.dll crash

> Psqlodbc.dll crashes my application occasionally with following error:
> Unhandled exception in VB6.EXE (PSQLODBC.DLL): 0xC0000005: Access
Violation.
>
> The error occurs when I have 3 opened ADO recordsets, I requery all of
them
> and then open one more recordset. And I have to do this 5-6 times to get
> this error. All recordsets are static and client-side. If someone could
send
> me debug version of the dll, I could give more information.
>
> Tambet
>
>

I resolved the issue, parameters of one of the recordsets did not have
default values. But it still indicates, that error handling in driver could
be improved. The query executed was:

conn=82461600, query='SELECT kood as "Kood", nimetus as "Nimetus",
prioriteet as "Prioriteet", mat_id, yhik, erikaal, viimane_hind,
broneeritud, olemas, tellitud, (mat.tellitud + mat.olemas - mat.broneeritud)
AS saldo FROM materjalid mat WHERE kood LIKE '' AND lower(nimetus) LIKE
lower('')'

Note the abnormal characters in where condition. The crash occurred in
convert_special_chars() in convert.c:

convert_special_chars(const char * 0x045fe000, char * 0x00000000, int -5,
int 1, int 0) line 3381 + 36 bytes
ResolveOneParam(_QueryBuild * 0x0012deec) line 2634 + 35 bytes
inner_process_tokens(_QueryParse * 0x0012df30, _QueryBuild * 0x0012deec)
line 2190 + 9 bytes
copy_statement_with_parameters(StatementClass_ * 0x04ffe3c8, int 0) line
1921 + 19 bytes
Exec_with_parameters_resolved(StatementClass_ * 0x04ffe3c8, int *
0x0012e0d4) line 222 + 13 bytes
PGAPI_Execute(void * 0x04ffe3c8) line 596 + 13 bytes
SQLExecute(void * 0x04ffe3c8) line 279 + 9 bytes
ODBC32! 1f7cd8eb()
MSDASQL! 1f6c78cb()
MSDASQL! 1f69c94b()
MSDASQL! 1f69c688()
0012e34c()

The error was on line 3381:

for (i = 0; i < max && si[i]; i++)

Probably because si[i] was out of bounds. But this should have been
eliminated by i < max condition. Max is calculated based on parameter 'used'
of the same function:

if (used == SQL_NTS)
max = strlen(si);
else
max = used;

As you can see from stack trace earlier, used = -5. But SQL_NTS is defined
as -1. This means, that max gets value -5. But as max is of unsigned type
(size_t), the actual value is 4294967291 instead. This allows above
mentioned cycle to go out of bounds.

I don't have the knowledge and time to fix this error by myself. But it
would be nice if someone could have a look.

Tambet

PS. Source distribution of psqlodbc.dll 7.2.5 was not complete, setup.c and
some other files were missing. I used the CVS snapshot, but still couldn't
compile the non-multibyte version. Multibyte version was OK.
PPS. It took me some time to find out how to access CVS on
gborg.postgresql.org. I could not find any official documentation on Gborg
website. Finally I found some instructions in list archives.