Skip to Content.
Sympa Menu

freetds - Re: [freetds] Crash selecting a blank TEXT field

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Luke Benstead" <kazade AT gmail.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] Crash selecting a blank TEXT field
  • Date: Mon, 4 Jun 2007 14:33:14 +0100

I'm still getting this with the latest nightly. Here is another log output:

util.c:162:Changed query state from PENDING to READING
token.c:533:processing result tokens. marker is d1(ROW)
token.c:2073:tds_process_row(): reading column 0
token.c:1825:tds_get_data: type 39, varint size 2
token.c:1882:tds_get_data(): wire column size is 5
token.c:2073:tds_process_row(): reading column 1
token.c:1825:tds_get_data: type 56, varint size 0
token.c:1882:tds_get_data(): wire column size is 4
token.c:2073:tds_process_row(): reading column 2
token.c:1825:tds_get_data: type 47, varint size 2
token.c:1882:tds_get_data(): wire column size is 1
token.c:2073:tds_process_row(): reading column 3
token.c:1825:tds_get_data: type 35, varint size 4
token.c:1882:tds_get_data(): wire column size is 8
token.c:2073:tds_process_row(): reading column 4
token.c:1825:tds_get_data: type 39, varint size 2
token.c:1882:tds_get_data(): wire column size is 44
token.c:2073:tds_process_row(): reading column 5
token.c:1825:tds_get_data: type 39, varint size 2
token.c:1882:tds_get_data(): wire column size is -1
token.c:2073:tds_process_row(): reading column 6
token.c:1825:tds_get_data: type 48, varint size 0
token.c:1882:tds_get_data(): wire column size is 1
token.c:2073:tds_process_row(): reading column 7
token.c:1825:tds_get_data: type 56, varint size 0
token.c:1882:tds_get_data(): wire column size is 4
token.c:2073:tds_process_row(): reading column 8
token.c:1825:tds_get_data: type 36, varint size 1
token.c:1882:tds_get_data(): wire column size is 16
token.c:2073:tds_process_row(): reading column 9
token.c:1825:tds_get_data: type 39, varint size 2
token.c:1882:tds_get_data(): wire column size is 5
token.c:2073:tds_process_row(): reading column 10
token.c:1825:tds_get_data: type 35, varint size 4
token.c:1882:tds_get_data(): wire column size is 72
token.c:2073:tds_process_row(): reading column 11
token.c:1825:tds_get_data: type 35, varint size 4
token.c:1882:tds_get_data(): wire column size is 0
token.c:2073:tds_process_row(): reading column 12
token.c:1825:tds_get_data: type 35, varint size 4
token.c:1882:tds_get_data(): wire column size is 0
token.c:2073:tds_process_row(): reading column 13
token.c:1825:tds_get_data: type 35, varint size 4
token.c:1882:tds_get_data(): wire column size is 0
token.c:2073:tds_process_row(): reading column 14
token.c:1825:tds_get_data: type 35, varint size 4
token.c:1882:tds_get_data(): wire column size is 0
token.c:2073:tds_process_row(): reading column 15
token.c:1825:tds_get_data: type 48, varint size 0
token.c:1882:tds_get_data(): wire column size is 1
token.c:2073:tds_process_row(): reading column 16
token.c:1825:tds_get_data: type 39, varint size 2
token.c:1882:tds_get_data(): wire column size is 0
token.c:2073:tds_process_row(): reading column 17
token.c:1825:tds_get_data: type 39, varint size 2
token.c:1882:tds_get_data(): wire column size is 0
token.c:2073:tds_process_row(): reading column 18
token.c:1825:tds_get_data: type 47, varint size 2
token.c:1882:tds_get_data(): wire column size is -1
token.c:2073:tds_process_row(): reading column 19
token.c:1825:tds_get_data: type 48, varint size 0
token.c:1882:tds_get_data(): wire column size is 1
token.c:2073:tds_process_row(): reading column 20
token.c:1825:tds_get_data: type 56, varint size 0
token.c:1882:tds_get_data(): wire column size is 4
util.c:162:Changed query state from READING to PENDING
odbc.c:3135:odbc_process_tokens: tds_process_tokens returned 1
odbc.c:3136: result_type=4040, TDS_DONE_COUNT=10, TDS_DONE_ERROR=0
odbc.c:3205:odbc_process_tokens: returning result_type 4040
odbc.c:4396:SQLGetData(0x844d548, 1, 1, 0xb6df3608, 2048, 0xb6df3600)
convert_tds2sql.c:62:convert_tds2sql: src is 39 dest = 1
convert_tds2sql.c:131:convert_tds2sql: outputting character data destlen =
2048
odbc.c:4396:SQLGetData(0x844d548, 2, 4, 0xb6df3e78, 4, 0xb6df3e84)
convert_tds2sql.c:62:convert_tds2sql: src is 56 dest = 4
odbc.c:4396:SQLGetData(0x844d548, 3, 1, 0x845b7d4, 5, 0xb6df3600)
convert_tds2sql.c:62:convert_tds2sql: src is 47 dest = 1
convert_tds2sql.c:131:convert_tds2sql: outputting character data destlen = 5

odbc.c:4396:SQLGetData(0x844d548, 4, 1, 0xb6df3608, 2048, 0xb6df3600)
convert_tds2sql.c:62:convert_tds2sql: src is 35 dest = 1
convert_tds2sql.c:131:convert_tds2sql: outputting character data destlen =
2048
odbc.c:4396:SQLGetData(0x844d548, 5, 1, 0xb6df3608, 2048, 0xb6df3600)
convert_tds2sql.c:62:convert_tds2sql: src is 39 dest = 1
convert_tds2sql.c:131:convert_tds2sql: outputting character data destlen =
2048
odbc.c:4396:SQLGetData(0x844d548, 6, 1, 0xb6df3608, 2048, 0xb6df3600)
odbc.c:4396:SQLGetData(0x844d548, 7, 4, 0xb6df3e78, 4, 0xb6df3e84)
convert_tds2sql.c:62:convert_tds2sql: src is 48 dest = 4
odbc.c:4396:SQLGetData(0x844d548, 8, 4, 0xb6df3e78, 4, 0xb6df3e84)
convert_tds2sql.c:62:convert_tds2sql: src is 56 dest = 4
odbc.c:4396:SQLGetData(0x844d548, 9, 1, 0x8438774, 37, 0xb6df3600)
convert_tds2sql.c:62:convert_tds2sql: src is 36 dest = 1
convert_tds2sql.c:131:convert_tds2sql: outputting character data destlen =
37
odbc.c:4396:SQLGetData(0x844d548, 10, 1, 0xb6df3608, 2048, 0xb6df3600)
convert_tds2sql.c:62:convert_tds2sql: src is 39 dest = 1
convert_tds2sql.c:131:convert_tds2sql: outputting character data destlen =
2048
odbc.c:4396:SQLGetData(0x844d548, 11, 1, 0xb6df3608, 2048, 0xb6df3600)
convert_tds2sql.c:62:convert_tds2sql: src is 35 dest = 1
convert_tds2sql.c:131:convert_tds2sql: outputting character data destlen =
2048
odbc.c:4396:SQLGetData(0x844d548, 12, 1, 0xb6df3608, 2048, 0xb6df3600)
odbc.c:4396:SQLGetData(0x844d548, 12, 1, 0xb76728ab, -2046, 0xb6df3600)

That's the very end of the log. If you need any more info just let me know.

Luke.

On 01/06/07, ZIGLIO, Frediano, VF-IT <Frediano.Ziglio AT vodafone.com> wrote:

> >
> > Luke Benstead wrote:
> > >
> > > I'm using 0.64. The bug doesn't occur with 0.63 but I get a
> > different
> > > bug (duplicate rows returned when there is a warning) with
> > 0.63 that is
> > > fixed in 0.64 :)
> >
> > :-) And this will be fixed, too, soon.
> >
> > > Setting a text-size does get rid of the crazy numbers,
> > setting a text
> > > size of 4000 in freetds.conf, sets the Server column size
> > to 4000 and
> > > the client one to 8000. Either way the bug still occurs.
> >
> > I.e., it still crashes?
> >
> > > The field is an ntext field that is empty (i.e a blank
> > string, not NULL)
> >
> > Thanks. I think we should add this to our unit tests. From your
> > description it sounds like a server bug. Where I come from
> > zero-length
> > strings have a length of zero, not infinite. But mine is
> basically a
> > Newtonian existence....
> >
>
> Try using
>
> static int
> determine_adjusted_size(const TDSICONV * char_conv, int size)
> {
> if (!char_conv)
> return size;
>
> if (size >= 0x10000000)
> return 0x2fffffff;
>
> size *= char_conv->client_charset.max_bytes_per_char;
> if (size % char_conv->server_charset.min_bytes_per_char)
> size += char_conv->server_charset.min_bytes_per_char;
> size /= char_conv->server_charset.min_bytes_per_char;
>
> return size;
> }
>
> (src/tds/token.c) this should avoid overflow.
>

I managed to reproduce the bug... Yes, it's a integer overflow problem
:(
Fixed in both branchs (CVS HEAD and 0.64, post 0.64 patch updated)

Looking at the code another time perhaps it would be better to divide
before multiply but it's only my paranoia :)

freddy77

_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/freetds





Archive powered by MHonArc 2.6.24.

Top of Page