FreeTDS Development Group

["Lowden, James K" <james.k.lowden AT alliancebernstein.com>]

> From: L J Bayuk
> Sent: Thursday, July 27, 2006 9:06 PM
> 
> I've been happily using FreeTDS-0.63 talking to Sybase SQL Anywhere
> (ASA), mostly with PHP and the sybase_ct module, and occasionally
> with sqsh.
> 
> I built and tested FreeTDS-0.64 and it crashes PHP in one of my
> tests.  The specific case is a TEXT type field (this is an unlimited
> length VARCHAR) with value NULL. When I select a record with a NULL
> text field, PHP crashes something like this:
>   #1  0x080f473b in _estrndup (s=0x81e125c "", length=136306688)
>      at .../php-4.4.2/Zend/zend_alloc.c:387
>   #2  0x40227ab7 in php_sybase_fetch_result_row (result=0x81ab678,
>   numrows=-1)
>      at .../sybase_ct/php_sybase_ct.c:1185
>   #3  0x40228346 in php_sybase_fetch_result_set (sybase_ptr=0x81b983c,
>      buffered=0, store=-1)
>      at .../sybase_ct/php_sybase_ct.c:1333
> Note that it is crashing in the PHP module, not FreeTDS/ctlib. But
> it isn't PHP's fault. See the length= parameter above. PHP is trying
> to store the result for the TEXT field. It should have gotten the
> message that the field is NULL, but it didn't, and ended up trying
> to copy an absurd amount of data. It works OK for CHAR and VARCHAR,
> but not for TEXT fields.
> 
> Speculation:  Using the TDSDUMP log, I see that in ctbind(),
> column_cur_size is set to 0, not -1 (which would set the indicator
> to -1 indicating NULL) for this TEXT type. But I think the cause
> is earlier.
> 
> Here's a bit of the TDSDUMP log. The query gets 1 record with 4
> fields: an INTEGER, a CHAR which is an empty string, a VARCHAR
> which is NULL, and a TEXT which is NULL.
> 
> token.c:526:processing result tokens.  marker is  d1(ROW)
> token.c:1863:tds_get_data: column 0, type 56, varint size 0
> token.c:1920:processing row.  column size is 4
token.c:1863:tds_get_data:
> column 1, type 39, varint size 1 token.c:1920:processing row.
> column size is 1 token.c:1863:tds_get_data: column 2, type 39,
> varint size 1 token.c:1920:processing row.  column size is -1
> token.c:1863:tds_get_data: column 3, type 35, varint size 4
> token.c:1920:processing row.  column size is 0
> 
> I think 'column size is 0' should be -1 in the last case, as that
> is the NULL indicator. But I'm over my head here. Help, please?

Thank you for the report.  I don't know what's wrong, but I don't think
that's it.  

I tried two queries in sqsh.  A zero-length text field reports a length
of 0; a NULL text field of -1.  

$ TDSDUMP=stdout sqsh  -C"set textsize 30 select cast('' as text) as
nothing" \
        | sed -ne'/^ *nothing/,/ct_results/p'
 nothing
 ------------------------------
ct.c:1454:ct_fetch()
util.c:119:Changing query state from PENDING to READING
token.c:526:processing result tokens.  marker is  d1(ROW)
token.c:1863:tds_get_data: column 0, type 35, varint size 4
token.c:1920:processing row.  column size is 0
                                            ^^^
util.c:119:Changing query state from READING to PENDING
ct.c:1519:inside ct_fetch()process_row_tokens returned 1
ct.c:1670:_ct_bind_data()
ct.c:1677:_ct_bind_data(): column_type: 35 column_len: 0
ct.c:1971:_ct_get_server_type(0)
ct.c:1858:_ct_get_client_type(type 35, user 0, size 30)
cs.c:351:cs_convert()
ct.c:1971:_ct_get_server_type(4)
ct.c:1971:_ct_get_server_type(0)
cs.c:358:cs_convert() srctype = 35 (0) desttype = 47 (31)
cs.c:371:cs_convert() srcdata is null

ct.c:1454:ct_fetch()
ct.c:1064:ct_results()

$ TDSDUMP=stdout sqsh  -C"set textsize 30 select cast(NULL as text) as
nothing" \
        | sed -ne'/^ *nothing/,/ct_results/p'
 nothing
 ------------------------------
ct.c:1454:ct_fetch()
util.c:119:Changing query state from PENDING to READING
token.c:526:processing result tokens.  marker is  d1(ROW)
token.c:1863:tds_get_data: column 0, type 35, varint size 4
token.c:1920:processing row.  column size is -1
                                             ^^^
util.c:119:Changing query state from READING to PENDING
ct.c:1519:inside ct_fetch()process_row_tokens returned 1
ct.c:1670:_ct_bind_data()
ct.c:1677:_ct_bind_data(): column_type: 35 column_len: -1
ct.c:1971:_ct_get_server_type(0)
 NULL
ct.c:1454:ct_fetch()
ct.c:1064:ct_results()

sqsh binds both correctly.  Do you see similar ct_bind_data messages
using PHP?  

I am using TDS 7.0, however, not 5.0 as with ASA.  Perhaps you could try
my queries on your server and let me know?  

Regards, 

--jkl

-----------------------------------------
The information contained in this transmission may be privileged and
confidential and is intended only for the use of the person(s) named
above. If you are not the intended recipient, or an employee or agent 
responsible
for delivering this message to the intended recipient, any review, 
dissemination,
distribution or duplication of this communication is strictly prohibited. If 
you are
not the intended recipient, please contact the sender immediately by reply 
e-mail
and destroy all copies of the original message. Please note that we do not 
accept
account orders and/or instructions by e-mail, and therefore will not be 
responsible
for carrying out such orders and/or instructions.  If you, as the intended 
recipient
of this message, the purpose of which is to inform and update our clients, 
prospects
and consultants of developments relating to our services and products, would 
not
like to receive further e-mail correspondence from the sender, please "reply" 
to the
sender indicating your wishes.  In the U.S.: 1345 Avenue of the Americas, New 
York,
NY 10105.