Bug #103664 SQLColAttribute SQL_DESC_TYPE_NAME sporadic junk data
Submitted: 11 May 2021 19:04 Modified: 11 Mar 17:33
Reporter: Farid Zidan (Candidate Quality Contributor) Email Updates:
Status: Not a Bug Impact on me:
None 
Category:Connector / ODBC Severity:S2 (Serious)
Version:8.0.24 ANSI 64-bit OS:Windows
Assigned to: CPU Architecture:x86

[11 May 2021 19:04] Farid Zidan
Description:
Randomly gets junk data for SQLColAttribute SQL_DESC_TYPE_NAME for the same resultset columns on different calls.

        // type_name
        nLen = SQL_NULL_DATA;
        memset(pRow->type_name, 0, sizeof(pRow->type_name));
        rc = SQLColAttribute(
                hstmt,
                nCol,
                SQL_DESC_TYPE_NAME,
                pRow->type_name,
                sizeof(pRow->type_name),
                &nLen,
                NULL);

How to repeat:
Call SQLColAttribute SQL_DESC_TYPE_NAME for a resultset, you get different junk data randomly sporadically.

With CompareData app (www.zidsoft.com)
1 Create MySQL 8 ODBC data source (ANSI)
2 Use the app data source repository wizard to create the app repository on the data source
3 Add a DBMS comparison for the data source to itself.
4 Perform columns comparison for the Tables tree item
6 observe junk data as differences between the table column data types for the same data source table/columns.

Suggested fix:
Driver appears to reference memory that is deallocated to copy the data name to the result buffer.
[11 May 2021 19:11] Farid Zidan
Sample screen shot of junk data comparing table columns to itself

Attachment: mysql_odbc.jpg (image/jpeg, text), 1.31 MiB.

[11 May 2021 19:26] Farid Zidan
This is tested with the 64-bit version of the driver.
[4 Oct 2021 12:46] MySQL Verification Team
Hello Farid Zidan,

Thank you for the bug report.
Could you please provide more information(test case, step by step process along with screenshots) to reproduce this issue at our end?

Regards,
Ashwini Patil
[4 Oct 2021 15:26] Farid Zidan
Screen shot and steps by step instructions on how to reproduce are included in the submission of this bug. Please see the bug submission.
[21 Feb 14:34] MySQL Verification Team
Hello Farid Zidan,

Thank you for the details.
Imho this is an expected behavior from the odbc. This can be confirmed from the app CompareData. Please see here https://www.zidsoft.com/dbmsnotes.html#mysql

Driver myodbc8a.dll has known issue with SQL_DESC_TYPE_NAME
Driver may return incorrect type name for resultset columns

Issue with SQLColAttribute SQL_DESC_TYPE_NAME where driver memory bug may result in a crash or junk data. 

Regards,
Ashwini Patil
[21 Feb 14:37] MySQL Verification Team
Please find the screenshot below

Attachment: 103664_test_results.png (image/png, text), 129.90 KiB.

[21 Feb 18:05] Farid Zidan
So you are saying it is not a bug for the MySQL ODBC driver to return junk data/crash executing SQL_DESC_TYPE_NAME ?

Driver should return the correct data type name for resultset columns and not crash nor return junk data. You have a bug in the ODBC driver where the driver is referencing memory that that is no longer there (dangling memory reference).

I put the error message in my app to alert user that the current version of MySQL ODBC driver has issues with getting the resultset column data type so user is alerted when see junk data returned by the driver.
[11 Mar 17:20] Farid Zidan
This is still happening sporadically.
The driver is referencing memory that is junk when copying the data type name to the client and driver may crash referencing the memory it is using for the operation.

Please see a screen shot showing junk data returned by the driver using the latest 8.00.0028 version of the ODBC driver.
[11 Mar 17:22] Farid Zidan
Junk type name returned by 8.00.0028 driver screen shot

Attachment: junk type name 2022-03-11 115306.jpg (image/jpeg, text), 522.12 KiB.

[11 Mar 17:25] Farid Zidan
Please try to reproduce this bug on your side rather than marking the issue as Not a Bug.

I am requesting to reopen this bug since it is clearly a bug for the driver to return junk data instead of actual data type name and referencing invalid memory that is invalid.
[11 Mar 17:32] Farid Zidan
Screen shot 2

Attachment: junk type name Screenshot 2022-03-11 123014.jpg (image/jpeg, text), 580.77 KiB.

[11 Mar 17:33] Farid Zidan
Added another screen shot showing another occurrence of the bug.