Bug #28655 for DBD-DB2: memory corruption in dbd_preparse

Turns out that my patch had an off-by-one error :) This version fixes that. -- Jonathan Rockway <jrockway@cpan.org>

Common subdirectories: DBD-DB2-1.0/Constants and DBD-DB2-1.0-fix28655/Constants diff -u DBD-DB2-1.0/dbdimp.c DBD-DB2-1.0-fix28655/dbdimp.c --- DBD-DB2-1.0/dbdimp.c 2006-11-09 12:13:42.000000000 -0600 +++ DBD-DB2-1.0-fix28655/dbdimp.c 2007-08-08 00:44:52.000000000 -0500 @@ -1396,6 +1396,56 @@ return TRUE; } +int _bytes_required(int statement_length, int placeholders) +{ + int bytes = statement_length; + + /* each placeholder requires at least two additional bytes: + ? -> :p1 + */ + bytes += 2 * placeholders; + + /* calculate number of bytes needed to represent all numbers + from 1 to 10**(digits-1) + the pattern here is: + 1 digit : 9 + 2 digits: 9 * 21 + 3 digits: 9 * 321 + 4 digits: 9 * 4321 + etc. + + we need this because ? -> :p1, ? -> :p2, ..., ? -> :p100000 + */ + + /* get number of digits */ + int digits = 0; + double d = (double) placeholders; + while(d >= 1) + { + d /= 10.0; + digits++; + } + + /* calculate the corresponding 54321 (etc.) for these digits */ + int digit_bytes = 0; + int i; + int pos = 0; + for(i = digits-1; i > 0; i--) + { + if (pos == 0) pos = 1; + pos *= 10; /* also calculate 10**(digits-1) */ + digit_bytes *= 10; + digit_bytes += i; + } + + /* add space for 1 -> 10**(d-1) */ + bytes += 9 * digit_bytes; + + /* add the rest from 10**(d-1) to #placeholders */ + bytes += digits * (placeholders - pos); + + return bytes; +} static void dbd_preparse( imp_sth_t *imp_sth, char *statement ) @@ -1406,11 +1456,11 @@ SV *phs_sv; int idx=0, style=0, laststyle=0; - /* allocate room for copy of statement with spare capacity */ - /* for editing ':1' into ':p1' so we can use obndrv. */ - imp_sth->statement = (SQLCHAR *)safemalloc(strlen(statement) + - (DBIc_NUM_PARAMS(imp_sth)*4)); - + /* allocate "bytes" room for copy of statement with spare capacity */ + /* for expanding ? to :p1, ..., p1000, ... and :1 to :p1 (etc.) */ + int bytes = _bytes_required(strlen(statement), DBIc_NUM_PARAMS(imp_sth)); + imp_sth->statement = (SQLCHAR *) safemalloc(bytes); + /* initialise phs ready to be cloned per placeholder */ memset(&phs_tpl, '\0',sizeof(phs_tpl)); phs_tpl.sv = NULL; Common subdirectories: DBD-DB2-1.0/lib and DBD-DB2-1.0-fix28655/lib Common subdirectories: DBD-DB2-1.0/t and DBD-DB2-1.0-fix28655/t

On Sat Mar 07 11:43:44 2009, IBMTORDB2 wrote: Show quoted text
ENV: DBD::DB2 version 1.61, perl v5.10.0 built for x86_64-linux, DB2 v9.5.0.0: The problem is reproducible using the attached perl script, which segfaults on my system when the number of bind variables is above 1000: $ perl -swl bug.28655.pl -N=1 -P=1 select foo from bar where id>? $ perl -swl bug.28655.pl -N=2 -P=1 select foo from bar where id>? and id>? $ perl -swl bug.28655.pl -N=3 -P=1 select foo from bar where id>? and id>? and id>? $ perl -swl bug.28655.pl -N=10 $ perl -swl bug.28655.pl -N=100 $ perl -swl bug.28655.pl -N=1000 $ perl -swl bug.28655.pl -N=10000 Segmentation fault $ See also attached cli trace file. The trace is run for the query that segfaults only. For values on N between ~1100 and ~1500 I get the following glibc error: $ perl -swl bug.28655.pl -N=1200 *** glibc detected *** perl: double free or corruption (!prev): 0x00000000103120c0 *** ======= Backtrace: ========= /lib64/libc.so.6[0x33e7e71834] /lib64/libc.so.6(cfree+0x8c)[0x33e7e74e7c] /opt/perl/lib/site_perl/5.10.0/x86_64-linux/auto/DBD/DB2/DB2.so(db2_st_destroy+0x7a)[0x2b94979ed3da] /opt/perl/lib/site_perl/5.10.0/x86_64-linux/auto/DBD/DB2/DB2.so(XS_DBD__DB2__st_DESTROY+0x12e)[0x2b94979e8cae] /opt/perl/lib/site_perl/5.10.0/x86_64-linux/auto/DBI/DBI.so(XS_DBI_dispatch+0x1b06)[0x2b94973bfd26] Best regards, Andreas --

use strict; use warnings; use DBD::DB2; our $N ||= 1; our $P ||= 0; # print flag my $DATABASE = "foo"; my $USERID = "bar"; my $PASSWORD = "*********"; my $dbh = DBI->connect("dbi:DB2:$DATABASE", "$USERID", "$PASSWORD", {PrintError => 0}); my $query = q{select foo from bar where } . join(q{ and }, ('id>?') x $N); print $query if $P; my $sth = $dbh->prepare($query); __END__