| Subject: | the fuction 'count_params' can call segfault (out of string access) |
I have a children of DBI which catches three methods:
prepare/prepare_cached and do. In these methods it appends to query-text
a comment with scriptname ($0) using code like:
sub prepare
{
my ($self, $query, @args) = @_;
return $self->SUPER::prepare("$query /* $0 */", @args);
}
Till now I used version 4.07 (Debian/lenny), today I've upgraded
DBD::mysql upto 4.014 and it became random crash with errors like:
DBD::mysql::db selectrow_hashref failed: called with 1 bind variables
when 3 are needed at ../lib/CRM/Session.pm line 47.
Line 47 contains code like:
my $svalue = dbh->selectrow_hashref(q{
SELECT * FROM session WHERE session = ?
}, undef, $sid);
I added 'die $query' into 'prepare' block and saw SQL:
"SELECT * FROM session WHERE session = ? /* /path/to/document.cgi */"
I don't see another '?' in SQL, but it wants.
I made a few experiments and found workarround:
If I add one space symbol after comment, it will work fine:
sub prepare
{
my ($self, $query, @args) = @_;
return $self->SUPER::prepare("$query /* $0 */ ", @args);
}
I looked through last revision of DBD::mysql and found that it has new
block which detect comments in SQL. Random character of the problem
forced me to look through Your new code and I found (I think I found)
the source of problem: look through dbdimp.c lines 132-141.
If SQL-statement is finished to '*/' then:
line 132: ptr points to symbol '/'
line 134: ptr points to symbol '\0' (EOF)
line 138: ptr points to symbol after '\0' (EOF)
then it search symbols and commentaries out of string of statement.
I think You should check code which detect other comments, too (I didn't)