MySQL Bugs: #118940: libmyodbc9a.so segfault when trying to update data in external MySQL table from Filemaker

Bug #118940	libmyodbc9a.so segfault when trying to update data in external MySQL table from Filemaker
Submitted:	4 Sep 18:18	Modified:	11 Sep 18:31
Reporter:	Chris Windle	Email Updates:
Status:	Verified	Impact on me:	None
Category:	Connector / ODBC	Severity:	S1 (Critical)
Version:	9.4.0	OS:	Ubuntu (24.04.3 LTS)
Assigned to:		CPU Architecture:	x86

Description:
Here are the two entries it created in the system log for the segfault:

Sep 04 12:00:31 <server name> kernel: fmserverd[608759]: segfault at 73e74616ea66 ip 000073e01ef66ccb sp 000073e0987e1a30 error 4 in libmyodbc9a.so[73e01ee9c000+1b6000] likely on CPU 1 (core 0, socket 0)
Sep 04 12:00:31 <server name> kernel: Code: eb a3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 85 ff 74 27 55 48 89 e5 53 48 89 fb 48 83 ec 08 0f 1f 00 48 89 df <48> 8b 1b e8 dd 98 f3 ff 48 85 db 75 f0 48 8b 5d f8 c9 c3 66 90 c3

How to repeat:
Attach to an external MySQL database from Filemaker, and create a form with any of the fields displayed in a text box, view the live data and then change the text field and leave the field to cause it to update the data and it immediately gets an exception in the filemaker server.

Hi,
I do not have access to filemaker. Can you reproduce this every time?

Yes, it happens every time accessing any field of any table that we have tried.  The database is a MySQL version 8.0.42 database that is running in Azure, so I also tried downgrading to 8.0.42 odbc driver using 8 I also downgraded to 8.0.42 community client drivers and the 8.4.0 odbc connector and saw the same issue.  It did not have any problem doing the same test of connecting and updating using the isql app.  If there is something we can do to assist you with debugging, please let me know. Thanks

Also, the version of UnixODBC we are using is 2.3.12

You can download a 45-day free trial of Filemaker with this link: https://www.claris.com/trial/

Thanks for the report

Posted by developer:
 
What makes us think it is a problem in the ODBC driver? The provided entry from the system log points at crash in `fmserverd` executable, i.e., the Filemaker server as I understand, but we have no trace confirming that the crash happened inside `libmyodbc9a.so` code. Do we have any evidence that the ODBC driver contributed to that crash?

As I understand the issue was first observed when using MySQL ODBC driver version 9.4.0 and also repeated with 8.4.0 and 8.0.42 drivers. Is that correct?

What made me think it was in the ODBC driver is in the log entry I posted that shows it was in fmserverd in the file libmyodbc9a.so, which starts at address 0x73e01ee9c000+1b6000 (and more specifically at ip = 0x73e01ef66ccb), which I believe would be offset 0x000caccb into the libmyodbc9a.so.

Sep 04 12:00:31 <server name> kernel: fmserverd[608759]: segfault at 73e74616ea66 ip 000073e01ef66ccb sp 000073e0987e1a30 error 4 in libmyodbc9a.so[73e01ee9c000+1b6000] likely on CPU 1 (core 0, socket 0)

A objdump shows that it looks like it was probably a stack overflow, maybe, because it seems to be at an offset that is wrong,  from the dump:

cab83:       4c 89 f8                mov    %r15,%rax
   cab86:       e9 ee 0a 00 00          jmp    cb679 <_Z12my_SQLSetPosPvmtt+0x175f>
   cab8b:       c7 85 90 fe ff ff 00    movl   $0x0,-0x170(%rbp)
   cab92:       00 00 00
   cab95:       48 c7 85 98 fe ff ff    movq   $0x0,-0x168(%rbp)
   cab9c:       00 00 00 00
   caba0:       48 c7 85 a0 fe ff ff    movq   $0x0,-0x160(%rbp)
   caba7:       00 00 00 00
   cabab:       c7 85 a8 fe ff ff 00    movl   $0x0,-0x158(%rbp)
   cabb2:       00 00 00
   cabb5:       48 c7 85 b0 fe ff ff    movq   $0x0,-0x150(%rbp)
   cabbc:       00 00 00 00
   cabc0:       66 c7 85 b8 fe ff ff    movw   $0x0,-0x148(%rbp)
   cabc7:       00 00
   cabc9:       48 c7 85 c0 fe ff ff    movq   $0x0,-0x140(%rbp)
   cabd0:       00 00 00 00
   cabd4:       66 c7 85 c8 fe ff ff    movw   $0x0,-0x138(%rbp)
   cabdb:       00 00
   cabdd:       c7 85 cc fe ff ff 00    movl   $0x0,-0x134(%rbp)
   cabe4:       00 00 00
   cabe7:       48 c7 85 d0 fe ff ff    movq   $0x0,-0x130(%rbp)
   cabee:       00 00 00 00
   cabf2:       66 c7 85 d8 fe ff ff    movw   $0x0,-0x128(%rbp)
   cabf9:       00 00
   cabfb:       48 c7 85 e0 fe ff ff    movq   $0x0,-0x120(%rbp)
   cac02:       00 00 00 00
   cac06:       48 c7 85 e8 fe ff ff    movq   $0x0,-0x118(%rbp)
   cac0d:       00 00 00 00
   cac11:       48 c7 85 f0 fe ff ff    movq   $0x0,-0x110(%rbp)
   cac18:       00 00 00 00
   cac1c:       48 c7 85 f8 fe ff ff    movq   $0x0,-0x108(%rbp)
   cac23:       00 00 00 00
   cac27:       48 c7 85 00 ff ff ff    movq   $0x0,-0x100(%rbp)
   cac2e:       00 00 00 00
   cac32:       48 c7 85 08 ff ff ff    movq   $0x0,-0xf8(%rbp)
   cac39:       00 00 00 00
   cac3d:       48 c7 85 10 ff ff ff    movq   $0x0,-0xf0(%rbp)
   cac44:       00 00 00 00
   cac48:       66 c7 85 18 ff ff ff    movw   $0x0,-0xe8(%rbp)
   cac4f:       00 00
   cac51:       c7 85 1c ff ff ff 00    movl   $0x0,-0xe4(%rbp)
   cac58:       00 00 00
   cac5b:       48 c7 85 20 ff ff ff    movq   $0x0,-0xe0(%rbp)
   cac62:       00 00 00 00
   cac66:       48 c7 85 28 ff ff ff    movq   $0x0,-0xd8(%rbp)
   cac6d:       00 00 00 00
   cac71:       66 c7 85 30 ff ff ff    movw   $0x0,-0xd0(%rbp)
   cac78:       00 00
   cac7a:       66 c7 85 32 ff ff ff    movw   $0x0,-0xce(%rbp)
   cac81:       00 00
   cac83:       66 c7 85 34 ff ff ff    movw   $0x0,-0xcc(%rbp)
   cac8a:       00 00
   cac8c:       66 c7 85 36 ff ff ff    movw   $0x0,-0xca(%rbp)
   cac93:       00 00
   cac95:       48 c7 85 38 ff ff ff    movq   $0x0,-0xc8(%rbp)
   cac9c:       00 00 00 00
   caca0:       66 c7 85 40 ff ff ff    movw   $0x0,-0xc0(%rbp)
   caca7:       00 00
   caca9:       48 c7 85 48 ff ff ff    movq   $0x0,-0xb8(%rbp)
   cacb0:       00 00 00 00
   cacb4:       66 c7 85 50 ff ff ff    movw   $0x0,-0xb0(%rbp)
   cacbb:       00 00
   cacbd:       48 c7 85 58 ff ff ff    movq   $0x0,-0xa8(%rbp)
   cacc4:       00 00 00 00
   cacc8:       66 c7 85 60 ff ff ff    movw   $0x0,-0xa0(%rbp)
   caccf:       00 00

Posted by developer:
 
Indeed, the log entry points to `libmyodbc9a.so` -- I was blind apparently -- sorry for that.