[IGNITE-16279] CPP: ODBC Incorrent usage of SQLBindParameter in TestStingParamNullLen cause to heap buffer overflow

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Duplicate
• Component/s: odbc, platforms
• Assignee: Ivan Daschinsky
• Reporter: Ivan Daschinsky
• Created: 12/Jan/22 13:52
• Updated: 18/Jan/22 15:37
• Resolved: 18/Jan/22 15:37

Description

Platform: ubuntu 20.04, UnixODBC 2.3.7

Index: modules/platforms/cpp/odbc/src/utility.cpp
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/modules/platforms/cpp/odbc/src/utility.cpp b/modules/platforms/cpp/odbc/src/utility.cpp
--- a/modules/platforms/cpp/odbc/src/utility.cpp	(revision e18bbbedfa23f4a4c7bcd1f4c48fa881411e5653)
+++ b/modules/platforms/cpp/odbc/src/utility.cpp	(date 1641994995236)
@@ -136,8 +136,10 @@
             if (!sqlStr || !sqlStrLen)
                 return res;
 
-            if (sqlStrLen == SQL_NTS)
+            if (sqlStrLen == SQL_NTS) {
+                std::cout << "Hopla " << sqlStrC << std::endl; // Here we go, unexpected.
                 res.assign(sqlStrC);
+            }
             else if (sqlStrLen > 0)
                 res.assign(sqlStrC, sqlStrLen);
 

Run TestStingParamNullLen under ASan and get report: https://gist.github.com/ivandasch/00fc80c31cb48022eed81a72ff3c4fc6

To run under sanitizer:
1. Add flags

set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=address -fno-omit-frame-pointer -fno-sanitize-recover -g")

2. Run

✗ JAVA_HOME=/opt/jdk/jdk1.8.0_281 ASAN_OPTIONS=handle_segv=0:detect_leaks=0:symbolize=1 IGNITE_NATIVE_TEST_ODBC_CONFIG_PATH=/home/ivandasch/Job/ignite-cpp/modules/platforms/cpp/odbc-test/config  ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer ./odbc-test/ignite-odbc-tests -t '*/TestStingParamNullLen'

P.S.
Seems that this is problem in test, in test we pass not NULL-terminated string and forget to add StrLen param at the end

Current code

   ret = SQLBindParameter(stmt, 1, SQL_PARAM_INPUT, SQL_C_CHAR, SQL_VARCHAR,
       paramData.size(), 0, &paramData[0], paramLen, 0);

Should be

ret = SQLBindParameter(stmt, 1, SQL_PARAM_INPUT, SQL_C_CHAR, SQL_VARCHAR,
       paramData.size(), 0, &paramData[0], paramLen, &paramLen);

Issue Links

• is fixed by: IGNITE-16278 CPP: Add sanitizers (UBSan and ASan at least) and run tests under them