| Bug #119507 | Connector/ODBC 9.5.0 crashes in bind_param() when binding UTF-8 text + BLOB under multi-threaded load | ||
|---|---|---|---|
| Submitted: | 4 Dec 11:29 | Modified: | 4 Dec 14:02 |
| Reporter: | zyshe kolodny | Email Updates: | |
| Status: | Open | Impact on me: | |
| Category: | Connector / ODBC | Severity: | S3 (Non-critical) |
| Version: | 9.5.0 (mysql-connector-odbc-9.5.0-1.el9. | OS: | CentOS (CentOS Stream 9 / RHEL 9 compatible (EL9 x86_64)) |
| Assigned to: | CPU Architecture: | x86 | |
[4 Dec 14:02]
zyshe kolodny
Additional information: • The crash happened only once so far, but under a very specific condition: - INSERT of a voicemail row via Connector/ODBC 9.5.0 - UTF-8 Hebrew callerid string - BLOB parameter (~12 KB WAV file) - At the same time another thread performed a SELECT on the same row. • I re-tested with the same UTF-8 callerid and a long voicemail (≈239 seconds, 3.8 MB WAV), and the INSERT and SELECT both worked without crashing. So the issue does not appear to be caused by the input data alone. • This points to a timing/concurrency problem inside the ODBC driver’s parameter binding (bind_param → memmove) rather than corrupted input or application misuse. • No hardware or OS errors are present on the system, and other services are unaffected. Asterisk continues running normally, and other nodes with identical configs have not crashed. Please advise if this is a known concurrency issue with Connector/ODBC 9.5.0 or if any workarounds or driver settings are recommended.
Description: MySQL Connector/ODBC 9.5.0 is crashing inside libmyodbc9a.so during SQLBindParameter() when used by a multi-threaded application (Asterisk PBX). The crash occurs inside memmove() while the driver is copying bound parameter data. The failing prepared statement is an INSERT with multiple bound parameters including: • A UTF-8 encoded callerid string containing Hebrew multibyte characters • A voicemail recording stored as a BLOB (~12.5 KB) • Several VARCHAR / INTEGER fields Stack trace excerpt: __memmove_avx_unaligned_erms_rtm() bind_param() insert_param() insert_params() my_SQLExecute() libmyodbc9a.so The crash occurs only with Connector/ODBC 9.5.0. The same workload works correctly with: • MariaDB Connector/ODBC • MySQL Connector/ODBC 8.0.x Additional details: Two threads operate concurrently: Thread 1 → INSERT INTO voicemail_messages ... (with UTF-8 + BLOB bound parameters) Thread 48 → SELECT FROM voicemail_messages ... (reading the same row msgnum=482) Both threads use their own ODBC HDBC/HSTMT handles; no handle is shared by the application. The crash always occurs during parameter binding for the INSERT. This strongly suggests a driver-level memory handling issue involving: • UTF-8 multibyte text • BLOB binding • Concurrent usage of Connector/ODBC 9.5.0 Asterisk does not write into driver buffers; it only supplies pointers + lengths. The memory corruption occurs inside the driver during bind_param(). How to repeat: Environment: • MySQL Connector/ODBC 9.5.0 (mysql-connector-odbc-9.5.0-1.el9.x86_64) • Application: Asterisk 20.16.0 using res_odbc + app_voicemail_odbc • DSN configured for MySQL 8.0 server (utf8mb4 charset) • CentOS/RHEL 9 environment Steps: 1. Configure Asterisk voicemail to store metadata + BLOB recording via ODBC. 2. Use DSN pointing to MySQL via Connector/ODBC 9.5.0. 3. Generate concurrent voicemail actions: - Thread A inserts a voicemail with: • UTF-8 Hebrew callerid • BLOB (~12 KB) - Thread B simultaneously retrieves voicemail messages (SELECT). 4. After several concurrent voicemail insertions, Connector/ODBC crashes inside: bind_param() → memmove() Repro rate: High under moderate load (2–3 simultaneous voicemail operations). Does NOT occur using MariaDB ODBC or Connector/ODBC 8.0. Suggested fix: Investigate memory handling inside bind_param() / insert_param() in libmyodbc9a.so, particularly: • Buffer sizing based on character count vs byte-length for UTF-8 • Handling of multi-byte text + BLOB parameters in the same prepared statement • Internal concurrency/thread-safety around descriptor/parameter buffers Connector/ODBC 9.5.0 appears to miscalculate buffer sizes or perform unsafe memmove() operations when binding multibyte UTF-8 strings alongside BLOB data. Providing guidance or a patch/workaround would be greatly appreciated.