MySQL Bugs: #79693: error code may be override in function server_list

Bug #79693	error code may be override in function server_list_dbcolumns()
Submitted:	18 Dec 2015 2:57	Modified:	15 Mar 2024 4:25
Reporter:	William ZHANG	Email Updates:
Status:	Can't repeat	Impact on me:	None
Category:	Connector / ODBC	Severity:	S2 (Serious)
Version:	5.3.4	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
In file driver\catalog_no_i_s.c:

static MYSQL_RES *
server_list_dbcolumns(STMT *stmt,
                      SQLCHAR *szCatalog, SQLSMALLINT cbCatalog,
                      SQLCHAR *szTable, SQLSMALLINT cbTable,
                      SQLCHAR *szColumn, SQLSMALLINT cbColumn)
{
<snipped>
  // NOTES: if mysql_list_fields() fails during the call of simple_command()
  //        which may set the error code.
  result= mysql_list_fields(mysql, buff, column_buff);

  // NOTES: without checking the value of result, the call mysql_select_db() 
  //        may success and override the error code.  Take the test case 
  //        t_bug31067 in my_catalog2.c for example.  If we inject the call
  //        mysql_list_fields() to make it fail, SQLColumns() should fail, 
  //        but since the error code override, it will succeed. 
  //        The test case will then calls SQLFetch(), and crash at
  //           assert(fields == ird->count); 
  //        in function
  //           void fill_ird_data_lengths(DESC *ird, ulong *lengths, uint fields)
  //        in source file:
  //           driver\results.c
  /* If before this call no database were selected - we cannot revert that */
  if (cbCatalog && dbc->database)
  {
    if (mysql_select_db( mysql, dbc->database))
    {
      /* Well, probably have to return error here */
      mysql_free_result(result);
      pthread_mutex_unlock(&dbc->lock);
      return NULL;
    }
  }
  pthread_mutex_unlock(&dbc->lock);

  return result;
}

How to repeat:
See above, esp. the comments marked with `NOTES:'.

Suggested fix:
Check the result of mysql_list_fields() just after the call.

Hello William ZHANG,

Thank you for the bug report.
Verified based on internal discussion with dev's.

Thanks,
Chiranjeevi.

Posted by developer:
 
The bug is closed.

The issue can no longer be reproduced after the usage of mysql_list_fields() function was removed.