FreeTDS Development Group

[L J Bayuk <ljb220 AT mindspring.com>]

I've been happily using FreeTDS-0.63 talking to Sybase SQL Anywhere (ASA),
mostly with PHP and the sybase_ct module, and occasionally with sqsh.

I built and tested FreeTDS-0.64 and it crashes PHP in one of my tests.
The specific case is a TEXT type field (this is an unlimited length
VARCHAR) with value NULL. When I select a record with a NULL text field,
PHP crashes something like this:
  #1  0x080f473b in _estrndup (s=0x81e125c "", length=136306688)
      at .../php-4.4.2/Zend/zend_alloc.c:387
  #2  0x40227ab7 in php_sybase_fetch_result_row (result=0x81ab678, numrows=-1)
      at .../sybase_ct/php_sybase_ct.c:1185
  #3  0x40228346 in php_sybase_fetch_result_set (sybase_ptr=0x81b983c, 
      buffered=0, store=-1)
      at .../sybase_ct/php_sybase_ct.c:1333
Note that it is crashing in the PHP module, not FreeTDS/ctlib. But it isn't
PHP's fault. See the length= parameter above. PHP is trying to store the
result for the TEXT field. It should have gotten the message that the
field is NULL, but it didn't, and ended up trying to copy an absurd amount
of data. It works OK for CHAR and VARCHAR, but not for TEXT fields.

Speculation:
Using the TDSDUMP log, I see that in ctbind(), column_cur_size is set to
0, not -1 (which would set the indicator to -1 indicating NULL) for this
TEXT type. But I think the cause is earlier.

Here's a bit of the TDSDUMP log. The query gets 1 record with 4 fields: an
INTEGER, a CHAR which is an empty string, a VARCHAR which is NULL, and a
TEXT which is NULL.

token.c:526:processing result tokens.  marker is  d1(ROW)
token.c:1863:tds_get_data: column 0, type 56, varint size 0
token.c:1920:processing row.  column size is 4
token.c:1863:tds_get_data: column 1, type 39, varint size 1
token.c:1920:processing row.  column size is 1
token.c:1863:tds_get_data: column 2, type 39, varint size 1
token.c:1920:processing row.  column size is -1
token.c:1863:tds_get_data: column 3, type 35, varint size 4
token.c:1920:processing row.  column size is 0

I think 'column size is 0' should be -1 in the last case, as that is the
NULL indicator. But I'm over my head here. Help, please?