Crash on entry modification in back-sql/unixODBC/oracle (ITS#2641)

[emmanuel.duru@atosorigin.com]

Full_Name: Emmanuel Duru
Version: 2.2.0 alpha
OS: solaris 8
URL: 
Submission from: (NULL) (195.68.44.148)


Crash on entry modification in back-sql/unixODBC/oracle.
The problem is that the back-end performs SQLBindParameter + SQLExecDirect on
at_delete query, whereas it should perform SQLPrepare + SQLBindParameter +
SQLExecute. 
Here is the stack trace:
(gdb) where
#0  0xff2b9794 in __sigprocmask () from /usr/lib/libthread.so.1
#1  0xff2ae9a8 in _resetsig () from /usr/lib/libthread.so.1
#2  0xff2ae148 in _sigon () from /usr/lib/libthread.so.1
#3  0xff2b1188 in _thrp_kill () from /usr/lib/libthread.so.1
#4  0xff04b760 in raise () from /usr/lib/libc.so.1
#5  0xff035a84 in abort () from /usr/lib/libc.so.1
#6  0x22f548 in Letext ()
#7  0xfec9c0a0 in ood_driver_bind_param (stmt=0x493a28, parmnum=3) at
oracle_functions.c:2653
#8  0xfec9810c in ood_driver_execute (stmt=0x493a28) at oracle_functions.c:506
#9  0xfec898d8 in SQLExecDirect (StatementHandle=0x493a28,
StatementText=0x304a58 "{call delete_phone(?,?)}", TextLength=-3)
    at SQLExecDirect.c:104
#10 0xff325ae8 in SQLExecDirect (statement_handle=0x493570,
statement_text=0x304a58 "{call delete_phone(?,?)}", text_length=-3)
    at SQLExecDirect.c:336
#11 0x9cce4 in backsql_modify_internal (op=0x0, rs=0xfd801ad8, dbh=0x317850,
oc=0x33ce90, e_id=0xfd801688, modlist=0x33da30)
    at modify.c:244
#12 0x9d744 in backsql_modify (op=0x3413a8, rs=0xfd801ad8) at modify.c:529
#13 0x5e38c in do_modify (op=0x3413a8, rs=0xfd801ad8) at modify.c:436
#14 0x4e1f4 in connection_operation (ctx=0xfd801b80, arg_v=0x3413a8) at
connection.c:968
#15 0xd8428 in ldap_int_thread_pool_wrapper (xpool=0x2cccb8) at tpool.c:463
(gdb) up
#1  0xff2ae9a8 in _resetsig () from /usr/lib/libthread.so.1
(gdb) up
#2  0xff2ae148 in _sigon () from /usr/lib/libthread.so.1
(gdb) up
#3  0xff2b1188 in _thrp_kill () from /usr/lib/libthread.so.1
(gdb) up
#4  0xff04b760 in raise () from /usr/lib/libc.so.1
(gdb) up
#5  0xff035a84 in abort () from /usr/lib/libc.so.1
(gdb) up
#6  0x22f548 in Letext ()
(gdb) up
#7  0xfec9c0a0 in ood_driver_bind_param (stmt=0x493a28, parmnum=3) at
oracle_functions.c:2653
2653      assert(IS_VALID(ap));
(gdb) up
#8  0xfec9810c in ood_driver_execute (stmt=0x493a28) at oracle_functions.c:506
506               ret|=ood_driver_bind_param(stmt,i);
(gdb) up
#9  0xfec898d8 in SQLExecDirect (StatementHandle=0x493a28,
StatementText=0x304a58 "{call delete_phone(?,?)}", TextLength=-3)
    at SQLExecDirect.c:104
104         status|=ood_driver_execute(stmt);
(gdb) up
#10 0xff325ae8 in SQLExecDirect (statement_handle=0x493570,
statement_text=0x304a58 "{call delete_phone(?,?)}", text_length=-3)
    at SQLExecDirect.c:336
336             ret = SQLEXECDIRECT( statement -> connection,
(gdb) up
#11 0x9cce4 in backsql_modify_internal (op=0x0, rs=0xfd801ad8, dbh=0x317850,
oc=0x33ce90, e_id=0xfd801688, modlist=0x33da30)
    at modify.c:244
244                                             rc = SQLExecDirect( sth,
(gdb) list 230
225                                             SQLBindParameter( sth, pno + 1 +
po,
226                                                     SQL_PARAM_INPUT,
227                                                     SQL_C_ULONG,
SQL_INTEGER,
228                                                     0, 0, &e_id->keyval, 0,
0 );
229     
230                                             /*
231                                              * check for syntax needed here

232                                              * maybe need binary bind?
233                                              */
234                                             SQLBindParameter(sth, pno + 2 -
po,
(gdb) list
235                                                     SQL_PARAM_INPUT,
236                                                     SQL_C_CHAR, SQL_CHAR,
237                                                     0, 0, row.cols[ i ],
238                                                     strlen( row.cols[ i ] ),
0 );
239                              
240                                             Debug( LDAP_DEBUG_TRACE, 
241                                                    
"backsql_modify_internal(): "
242                                                     "executing '%s'\n",
243                                                     at->delete_proc, 0, 0
);
244                                             rc = SQLExecDirect( sth,
(gdb) list
245                                                     at->delete_proc, SQL_NTS
);