php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43681 PDO-ODBC crashes unixODBC due to not binding columns on "long" data
Submitted: 2007-12-26 20:42 UTC Modified: 2009-05-03 01:00 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:1 (100.0%)
From: bugs dot php dot net at zetafleet dot com Assigned:
Status: No Feedback Package: PDO related
PHP Version: 5.2.5 OS: Linux (Ubuntu 7.04)
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: bugs dot php dot net at zetafleet dot com
New email:
PHP Version: OS:

 

 [2007-12-26 20:42 UTC] bugs dot php dot net at zetafleet dot com
Description:
------------
PDO-ODBC causes unixODBC to crash when fetching data because it does not bind all the columns in odbc_stmt.c if there are "long" (data > 256b) columns, resulting in a NULL pointer dereference in unixODBC at SQLGetData:472 (line number is for the current CVS version of unixODBC; release versions may differ. The line is "bound_columns = bound_columns -> next").

The affected code may be odbc_stmt.c:422-439. I have solved the crash by commenting out the branch, but this is not the correct solution since it will now potentially allocate a huge amount of memory.

Reproduce code:
---------------
Create a table in MSSQL like:

CREATE TABLE Frontpage (
  ID smallint identity,
  Title nvarchar,
  SectionUpdate text,
  Category nvarchar,
  Date smalldatetime,
  Link nvarchar );

<?php

$pdo = new PDO('odbc:NewMain', 'imageboston', 'ib86385');
$stmt = $pdo->query('SELECT * FROM Frontpage');
$result = $stmt->fetchAll(PDO::FETCH_NUM);

echo count($result);

?>

Expected result:
----------------
"42" (or however many rows are in the table)

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47223378858528 (LWP 14883)]
0x00002af315aa93e4 in CLGetData (statement_handle=0xe34f00, column_number=3, target_type=1, target_value=0xdca8f0, buffer_length=256, strlen_or_ind=0xdd0420) at SQLGetData.c:472
472             bound_columns = bound_columns -> next;
(gdb) bt
#0  0x00002af315aa93e4 in CLGetData (statement_handle=0xe34f00, column_number=3, target_type=1, target_value=0xdca8f0, buffer_length=256, strlen_or_ind=0xdd0420)
    at SQLGetData.c:472
#1  0x00002af312debb4e in SQLGetData (statement_handle=0xe34880, column_number=3, target_type=1, target_value=0xdca8f0, buffer_length=256, strlen_or_ind=0xdd0420)
    at SQLGetData.c:439
#2  0x00002af3138eacd7 in odbc_stmt_get_col (stmt=0xdcfe00, colno=2, ptr=0x7fffa10faa38, len=0x7fffa10faa30, caller_frees=0x7fffa10faa90)
    at /home/colin/software/source/php5-5.2.1/ext/pdo_odbc/odbc_stmt.c:460
#3  0x00002af313068c35 in fetch_value (stmt=0xdcfe00, dest=0xdd1370, colno=2, type_override=0x0) at /home/colin/software/source/php5-5.2.1/ext/pdo/pdo_stmt.c:512
#4  0x00002af31306a2d9 in do_fetch (stmt=0xdcfe00, do_bind=1, return_value=0xdd1180, how=PDO_FETCH_NUM, ori=PDO_FETCH_ORI_NEXT, offset=0, return_all=0x0)
    at /home/colin/software/source/php5-5.2.1/ext/pdo/pdo_stmt.c:1017
#5  0x00002af31306b9fa in zim_PDOStatement_fetchAll (ht=1, return_value=0xdcf9b8, return_value_ptr=0x0, this_ptr=0xdcf9e0, return_value_used=1)
    at /home/colin/software/source/php5-5.2.1/ext/pdo/pdo_stmt.c:1494
#6  0x0000000000676642 in ?? ()
#7  0x0000000000666cac in execute ()
#8  0x0000000000647cd3 in zend_execute_scripts ()
#9  0x0000000000606288 in php_execute_script ()
#10 0x00000000006d0960 in main ()

(Please ignore the source version; this problem exists also in 5.2.5 (pdo_odbc hasn't changed) -- I just happened to compile with full debug information for 5.2.1-0ubuntu1.5.)

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-04-25 14:52 UTC] jani@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/


 [2009-05-03 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu May 16 08:01:33 2024 UTC