Bug 1374173 - sigsegv in unixODBC in __info.c
Summary: sigsegv in unixODBC in __info.c
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: unixODBC
Version: 7.2
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Tomas Repik
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-08 07:43 UTC by Nikola Pajkovsky
Modified: 2016-11-04 13:01 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-19 08:00:34 UTC
Target Upstream Version:


Attachments (Terms of Use)
fix (2.50 KB, patch)
2016-09-08 07:43 UTC, Nikola Pajkovsky
no flags Details | Diff

Description Nikola Pajkovsky 2016-09-08 07:43:59 UTC
Created attachment 1198924 [details]
fix

Well, I'm using perl and Vertica to trigger the bug, but it can be very easy to trigger it differently. What you have to get is loooong error message from db, which cannot fit into buffer.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff7fe4740 (LWP 13675)]
wide_strcpy (str1=0x7ffffffff000, str1@entry=0x7fffffffc430, str2=0x7fffffffec00, str2@entry=0x7fffffffc030) at __info.c:3585
3585	        *str1 = *str2;
(gdb) bt
#0  wide_strcpy (str1=0x7ffffffff000, str1@entry=0x7fffffffc430, str2=0x7fffffffec00, str2@entry=0x7fffffffc030) at __info.c:3585
#1  0x00007fffe7e7a96c in extract_diag_error_w (handle=0x7, connection=0x27a29a0, head=0x2e94e60, return_code=-1, save_to_diag=0, htype=<optimized out>) at __info.c:4463
#2  0x0074007300690078 in ?? ()  <--- Vertica is stripped very nicely
#3  0x00220074006e0065 in ?? ()  <--- Vertica is stripped very nicely
...

Now, I'm attaching patch, which fix the problem, and it's taken from upstream svn repository.

  svn log -r r125:126 --diff

Steps to Reproduce:
Execute on Vertica select like that: SELECT audit('db.table', 'table', 10) audit_table_size;

Expected results:
Program does not sigsegv

Additional info:
Long vertica error which triggers the bug

Usage: 

Summary: Runs an audit of the provided database entity to determine the raw output size of the data it contains. Results are presented in the dc_user_audits table.

Syntax: select audit('entity_name');
        select audit('entity_name','error_tolerance');
        select audit('entity_name','error_tolerance','confidence_level');
        select audit('entity_name','error_tolerance');
        select audit('entity_name','granularity','error_tolerance');
        select audit('entity_name','granularity','error_tolerance','confidence_level');

Entity name can be '' to signify the entire database or the name of a schema, table or projection.
Granularity can be DATABASE, SCHEMA, or TABLE and must be a subset of or equivalent to the entity provided. The default behavior sets granularity equivalent to the entity.
Error tolerance indicates the maximum expected error to permit. This must between 0 and 1 inclusive, where 1 represents 100% error. The default is 5%, or .05.
The confidence level determines the statistical confidence level used to evaluate results. This must be between 0 and 1 inclusive. The default is 99%, or .99. Only change this if you know what you're doing.

Examples:
audit('')    -- audit the entire database with default values
audit('projection_name','TABLE',.1)    -- same as audit('projection_name'), audit the provided projection allowing up 10% expected error
audit('the_schema','TABLE');    -- audit all the tables in the_schema individually
audit('the_schema')    -- audit the size of the_schema

Comment 2 Tomas Repik 2016-09-09 06:57:45 UTC
I can't reproduce the bug based on the given information.
What version of unixODBC are you using?
Where does the Vertica come from?
Could you be more specific in steps you do to trigger the SIGSEGV?

The patch looks reasonable but I need to test it first.

Comment 3 Nikola Pajkovsky 2016-09-09 07:59:40 UTC
(In reply to Tomas Repik from comment #2)
> I can't reproduce the bug based on the given information.
> What version of unixODBC are you using?

$ rpm -q unixODBC
unixODBC-2.3.4-1.el7.centos.gdc1.x86_64

> Where does the Vertica come from?

Vertica is columnar db from HP.

> Could you be more specific in steps you do to trigger the SIGSEGV?

Connect to Vertica database and run: select audit('foo');

or use minimal reproducer, which does to the same as above:
perl -MDBI -E $'$q = DBI->connect("dbi:ODBC:driver=vertica;database=db;server=localhost", "passwd"); $q->selectall_arrayref("select audit(\'foo\')")'

Comment 4 Tomas Repik 2016-09-15 11:39:31 UTC
(In reply to Nikola Pajkovsky from comment #3)
> $ rpm -q unixODBC
> unixODBC-2.3.4-1.el7.centos.gdc1.x86_64
I can see you have a centos package so you probably should have filled a bug elsewhere. Nevertheless I'm gonna look for the flaw in fedora package and fix it there.


Note You need to log in before you can comment on or make changes to this bug.