[ODBC-235] 64-Bit ODBC Access Violation for long text Created: 2019-03-18  Updated: 2021-04-14

Status: Stalled
Project: MariaDB Connector/ODBC
Component/s: General
Affects Version/s: 3.1.0
Fix Version/s: None

Type: Bug Priority: Minor
Reporter: Peter Godwin Assignee: Lawrin Novitsky
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Windows Server 2012R2 X64
ODBC 64-BIT 3.1 RC

Attachments: Text File SQL.LOG     Text File WinDbg Analyze result.txt    

 Description   

I still need to develop a test case, but when switching from the 32-bit to 64-bit driver I'm getting access violation exceptions in ntdll.dll.

Unhandled exception at 0x00007FFE33F07A3D (ntdll.dll) in SQLDmpr0005.mdmp: 0xC0000005: Access violation reading location 0x000000914B66E004.
 
The thread tried to read from or write to a virtual address for which it does not have the appropriate access.

Stack trace from Visual Studio debugger:

>	ntdll.dll!CountUnicodeToUTF8()	Unknown
 
 	KERNELBASE.dll!WideCharToMultiByte()	Unknown
 
 	maodbc.dll!MADB_ConvertFromWChar(const wchar_t * Wstr, long WstrCharLen, unsigned __int64 * Length, st_client_charset * cc, int * Error) Line 145	C
 
 	maodbc.dll!MADB_Wchar2Sql(st_ma_odbc_stmt * Stmt, MADB_DescRecord * CRec, void * DataPtr, __int64 Length, MADB_DescRecord * SqlRec, st_mysql_bind * MaBind, void * * Buffer, unsigned long * LengthPtr) Line 342	C
 
 	maodbc.dll!MADB_ConvertC2Sql(st_ma_odbc_stmt * Stmt, MADB_DescRecord * CRec, void * DataPtr, __int64 Length, MADB_DescRecord * SqlRec, st_mysql_bind * MaBind, void * * Buffer, unsigned long * LengthPtr) Line 691	C
 
 	maodbc.dll!MADB_ExecuteBulk(st_ma_odbc_stmt * Stmt, unsigned int ParamOffset) Line 373	C
 
 	maodbc.dll!MADB_StmtExecute(st_ma_odbc_stmt * Stmt, int ExecDirect) Line 1112	C
 
 	maodbc.dll!SQLExecute(void * StatementHandle) Line 1347	C
 
 	[External Code]

I can cause the issue reliably from the integration package I have, but am still trying to build a test case.
Attached is the windbg ! analyze output from the minidump if it'll help.

Edit: still no luck developing a test case for this one. Works fine with the 32-bit driver, but crashes with the above in 64-Bit, which suggests maybe type related difference between the builds? Only other thing to mention is that there is 20 threads running when this crash occurs.

Edit2: Nothing to do with the threads. Seems to the mediumtext field. See first comment below. Added updated WinDBG analyze results and the ODBC Trace.



 Comments   
Comment by Peter Godwin [ 2019-03-19 ]

Tracked it down to another table with a text field (in this case mediumtext to work around the issue with longtext crashing out SSIS).

DDL

 
CREATE TABLE `allergy_comment` (
 
  `ALLERGY_COMMENT_ID` double NOT NULL,
 
  `ALLERGY_INSTANCE_ID` double NOT NULL,
 
  `ALLERGY_ID` double NOT NULL,
 
  `COMMENT_DT_TM` datetime DEFAULT NULL,
 
  `COMMENT_PRSNL_ID` double NOT NULL,
 
  `ALLERGY_COMMENT` mediumtext DEFAULT NULL,
 
  `ACTIVE_IND` double DEFAULT NULL,
 
  `ACTIVE_STATUS_CD` double NOT NULL,
 
  `ACTIVE_STATUS_DT_TM` datetime DEFAULT NULL,
 
  `ACTIVE_STATUS_PRSNL_ID` double NOT NULL,
 
  `BEG_EFFECTIVE_DT_TM` datetime NOT NULL,
 
  `END_EFFECTIVE_DT_TM` datetime NOT NULL,
 
  `CONTRIBUTOR_SYSTEM_CD` double NOT NULL,
 
  `DATA_STATUS_CD` double NOT NULL,
 
  `DATA_STATUS_DT_TM` datetime DEFAULT NULL,
 
  `DATA_STATUS_PRSNL_ID` double NOT NULL,
 
  `UPDT_APPLCTX` double NOT NULL,
 
  `UPDT_CNT` double NOT NULL,
 
  `UPDT_DT_TM` datetime NOT NULL,
 
  `UPDT_ID` double NOT NULL,
 
  `UPDT_TASK` double NOT NULL,
 
  `COMMENT_TZ` double DEFAULT NULL,
 
  `BEG_EFFECTIVE_TZ` double DEFAULT NULL,
 
  `CMB_COMMENT_ID` double NOT NULL,
 
  `CMB_PRSNL_ID` double NOT NULL,
 
  `CMB_PERSON_ID` double NOT NULL,
 
  `CMB_DT_TM` datetime DEFAULT NULL,
 
  `CMB_TZ` double DEFAULT NULL,
 
  `CMB_FLAG` double NOT NULL,
 
  `LAST_UTC_TS` datetime(6) DEFAULT NULL,
 
  `Audit_CreateJobId` bigint(20) DEFAULT NULL,
 
  `Audit_CreateDate` datetime(6) NOT NULL DEFAULT current_timestamp(6),
 
  `Audit_UpdateJobId` bigint(20) DEFAULT NULL,
 
  `Audit_UpdateDate` datetime(6) DEFAULT NULL,
 
  `Audit_Deleted` tinyint(1) NOT NULL DEFAULT 0,
 
  `Audit_DeleteJobId` bigint(20) DEFAULT NULL,
 
  `Audit_DeletedDate` datetime(6) DEFAULT NULL,
 
  `Audit_ValidFrom` datetime(6) DEFAULT NULL,
 
  `Audit_ValidUntil` datetime(6) DEFAULT NULL,
 
  PRIMARY KEY (`ALLERGY_COMMENT_ID`),
 
  KEY `ALLERGY_COMMENT_XIF2ALLERGY_COMMENT` (`ALLERGY_ID`),
 
  KEY `ALLERGY_COMMENT_XIF6ALLERGY_COMMENT` (`ALLERGY_INSTANCE_ID`)
 
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

ODBC Trace:
SQL.LOG

SQLColumns:

SQLColumns:
 
    In:    StatementHandle = 0x000000000033B690, CatalogName = SQL_NULL_HANDLE, NameLength1 = 0, SchemaName = SQL_NULL_HANDLE, NameLength2 = 0, 
          TableName = "allergy_comment", NameLength3 = 15, ColumnName = SQL_NULL_HANDLE, NameLength4 = 0
 
    Return: SQL_SUCCESS=0
 
 
 
Get Data All:
 
"TABLE_CAT", "TABLE_SCHEM", "TABLE_NAME", "COLUMN_NAME", "DATA_TYPE", "TYPE_NAME", "COLUMN_SIZE", "BUFFER_LENGTH", "DECIMAL_DIGITS", "NUM_PREC_RADIX", "NULLABLE", "REMARKS", "COLUMN_DEF", "SQL_DATA_TYPE", "SQL_DATETIME_SUB", "CHAR_OCTET_LENGTH", "ORDINAL_POSITION", "IS_NULLABLE"
 
"iemr_test", <Null>, "allergy_comment", "ALLERGY_COMMENT_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 1, "NO"
 
"iemr_test", <Null>, "allergy_comment", "ALLERGY_INSTANCE_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 2, "NO"
 
"iemr_test", <Null>, "allergy_comment", "ALLERGY_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 3, "NO"
 
"iemr_test", <Null>, "allergy_comment", "COMMENT_DT_TM", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 4, "YES"
 
"iemr_test", <Null>, "allergy_comment", "COMMENT_PRSNL_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 5, "NO"
 
"iemr_test", <Null>, "allergy_comment", "ALLERGY_COMMENT", -10, "MEDIUMTEXT", 16777215, 67108860, <Null>, <Null>, 1, "", "NULL", -10, <Null>, 67108860, 6, "YES"
 
"iemr_test", <Null>, "allergy_comment", "ACTIVE_IND", 8, "DOUBLE", 15, 8, <Null>, 10, 1, "", "NULL", 8, <Null>, 4, 7, "YES"
 
"iemr_test", <Null>, "allergy_comment", "ACTIVE_STATUS_CD", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 8, "NO"
 
"iemr_test", <Null>, "allergy_comment", "ACTIVE_STATUS_DT_TM", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 9, "YES"
 
"iemr_test", <Null>, "allergy_comment", "ACTIVE_STATUS_PRSNL_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 10, "NO"
 
"iemr_test", <Null>, "allergy_comment", "BEG_EFFECTIVE_DT_TM", 93, "DATETIME", 19, 16, <Null>, 10, 0, "", <Null>, 9, 3, <Null>, 11, "NO"
 
"iemr_test", <Null>, "allergy_comment", "END_EFFECTIVE_DT_TM", 93, "DATETIME", 19, 16, <Null>, 10, 0, "", <Null>, 9, 3, <Null>, 12, "NO"
 
"iemr_test", <Null>, "allergy_comment", "CONTRIBUTOR_SYSTEM_CD", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 13, "NO"
 
"iemr_test", <Null>, "allergy_comment", "DATA_STATUS_CD", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 14, "NO"
 
"iemr_test", <Null>, "allergy_comment", "DATA_STATUS_DT_TM", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 15, "YES"
 
"iemr_test", <Null>, "allergy_comment", "DATA_STATUS_PRSNL_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 16, "NO"
 
"iemr_test", <Null>, "allergy_comment", "UPDT_APPLCTX", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 17, "NO"
 
"iemr_test", <Null>, "allergy_comment", "UPDT_CNT", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 18, "NO"
 
"iemr_test", <Null>, "allergy_comment", "UPDT_DT_TM", 93, "DATETIME", 19, 16, <Null>, 10, 0, "", <Null>, 9, 3, <Null>, 19, "NO"
 
"iemr_test", <Null>, "allergy_comment", "UPDT_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 20, "NO"
 
"iemr_test", <Null>, "allergy_comment", "UPDT_TASK", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 21, "NO"
 
"iemr_test", <Null>, "allergy_comment", "COMMENT_TZ", 8, "DOUBLE", 15, 8, <Null>, 10, 1, "", "NULL", 8, <Null>, 4, 22, "YES"
 
"iemr_test", <Null>, "allergy_comment", "BEG_EFFECTIVE_TZ", 8, "DOUBLE", 15, 8, <Null>, 10, 1, "", "NULL", 8, <Null>, 4, 23, "YES"
 
"iemr_test", <Null>, "allergy_comment", "CMB_COMMENT_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 24, "NO"
 
"iemr_test", <Null>, "allergy_comment", "CMB_PRSNL_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 25, "NO"
 
"iemr_test", <Null>, "allergy_comment", "CMB_PERSON_ID", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 26, "NO"
 
"iemr_test", <Null>, "allergy_comment", "CMB_DT_TM", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 27, "YES"
 
"iemr_test", <Null>, "allergy_comment", "CMB_TZ", 8, "DOUBLE", 15, 8, <Null>, 10, 1, "", "NULL", 8, <Null>, 4, 28, "YES"
 
"iemr_test", <Null>, "allergy_comment", "CMB_FLAG", 8, "DOUBLE", 15, 8, <Null>, 10, 0, "", <Null>, 8, <Null>, 4, 29, "NO"
 
"iemr_test", <Null>, "allergy_comment", "LAST_UTC_TS", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 30, "YES"
 
"iemr_test", <Null>, "allergy_comment", "Audit_CreateJobId", -5, "BIGINT", 19, 20, 0, 10, 1, "", "NULL", -5, <Null>, 3, 31, "YES"
 
"iemr_test", <Null>, "allergy_comment", "Audit_CreateDate", 93, "DATETIME", 19, 16, <Null>, 10, 0, "", "current_timestamp(6)", 9, 3, <Null>, 32, "NO"
 
"iemr_test", <Null>, "allergy_comment", "Audit_UpdateJobId", -5, "BIGINT", 19, 20, 0, 10, 1, "", "NULL", -5, <Null>, 3, 33, "YES"
 
"iemr_test", <Null>, "allergy_comment", "Audit_UpdateDate", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 34, "YES"
 
"iemr_test", <Null>, "allergy_comment", "Audit_Deleted", -6, "TINYINT", 3, 1, 0, 10, 0, "", "0", -6, <Null>, 1, 35, "NO"
 
"iemr_test", <Null>, "allergy_comment", "Audit_DeleteJobId", -5, "BIGINT", 19, 20, 0, 10, 1, "", "NULL", -5, <Null>, 3, 36, "YES"
 
"iemr_test", <Null>, "allergy_comment", "Audit_DeletedDate", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 37, "YES"
 
"iemr_test", <Null>, "allergy_comment", "Audit_ValidFrom", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 38, "YES"
 
"iemr_test", <Null>, "allergy_comment", "Audit_ValidUntil", 93, "DATETIME", 19, 16, <Null>, 10, 1, "", "NULL", 9, 3, <Null>, 39, "YES"
 
39 rows fetched from 18 columns.

Comment by Lawrin Novitsky [ 2019-03-19 ]

Thank you for yet another report! I'll get to it in its turn. I guess I have enough to start with.

Comment by Peter Godwin [ 2019-04-03 ]

Hi Lawrin, checking to see if there's anything else you might need to help with this?

Comment by Lawrin Novitsky [ 2019-04-03 ]

Hi Peter, no, I am just still busy with other things. Callstack gives enough info to start with - this is probably upsert statement with array of parameters involving longtext field. Plus, as you said, 64bit apparently plays important role here

Comment by Peter Godwin [ 2019-04-04 ]

No worries Lawrin - just tag me if you need anything.

Comment by Lawrin Novitsky [ 2021-03-11 ]

godwinpe Hi, sorry this issue got lost from my radars for quite a long while. I am trying to reproduce it, but without much success. Not giving up yet, but wanted to ask if you are still available to answer my questions and maybe help with some tests?

Comment by Lawrin Novitsky [ 2021-03-12 ]

Ok, found something in the trace. SSIS passes 0 as BufferLength for mediumtext column, which our connector would use as parameter array element size to calculate address of the each subsequent array member. And that is why specs say: "BufferLength Argument. For character and binary C data, the BufferLength argument specifies the length of the *ParameterValuePtr buffer (if it is a single element) or the length of an element in the *ParameterValuePtr array (if the value in the SQL_ATTR_PARAMSET_SIZE statement attribute is greater than 1)." And I can't see anywhere that corresponding descriptor field is set anywhere directly. But that doesn't explain the crash. That only causes, that first array element value will be used for all records.
But while I was writing I found one more thing. StrLen_or_IndPtr argument for that parameter SQLLEN * 0x0000003577913BB0 (214943990096)
The number in parenthesis and it's too big, like 200G. Usually in trace it shows the value pointed by the pointer at the function exit. If it was really so, that could easily cause the crash. I honestly can't think how the reason of that could be in the connector. It's strange, that the same number is showed for all SQLBindParam calls. But for fixed size types that would not matter.

Generated at Thu Feb 08 03:27:13 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.