From 4cf222c082950ff6a713792f68e2a2882135199e Mon Sep 17 00:00:00 2001

From: Bogdan Degtyariov <bogdan.degtyariov@oracle.com>

Date: Wed, 4 Sep 2013 16:46:27 +1000

Subject: [PATCH] Memory leak in SQLPrepare with queries that use parameters

 (Bug# 17400483/70113) - no test case

---

 ChangeLog                 |  2 ++

 driver/catalog_no_i_s.c   |  1 +

 driver/my_prepared_stmt.c | 21 ++++++++++++++-------

 driver/my_stmt.c          | 35 ++++++++++++++++++++++-------------

 4 files changed, 39 insertions(+), 20 deletions(-)

diff --git a/driver/catalog_no_i_s.c b/driver/catalog_no_i_s.c

index ac54d3e..be4d616 100644

--- a/driver/catalog_no_i_s.c

+++ b/driver/catalog_no_i_s.c

@@ -2141,6 +2141,7 @@ mysql_tables(SQLHSTMT hstmt,

       if (!row_count)

       {

         mysql_free_result(stmt->result);

+        stmt->result= NULL;

         goto empty_set;

       }

diff --git a/driver/my_prepared_stmt.c b/driver/my_prepared_stmt.c

index 71a5648..126d892 100644

--- a/driver/my_prepared_stmt.c

+++ b/driver/my_prepared_stmt.c

@@ -1,5 +1,5 @@

 /*

-  Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.

+  Copyright (c) 2012-2013, Oracle and/or its affiliates. All rights reserved.

   The MySQL Connector/ODBC is licensed under the terms of the GPLv2

   <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most

@@ -223,10 +223,17 @@ void free_result_bind(STMT *stmt)

 {

   if (stmt->result_bind != NULL)

   {

+    int i, field_cnt= field_count(stmt);

+

     x_free(stmt->result_bind[0].is_null);

     x_free(stmt->result_bind[0].length);

     x_free(stmt->result_bind[0].error);

-    x_free(stmt->result_bind[0].buffer);

+

+    /* buffer was allocated for each column */

+    for (i= 0; i < field_cnt; i++)

+    {

+      x_free(stmt->result_bind[i].buffer);

+    }

     x_free(stmt->result_bind);

     stmt->result_bind= 0;

@@ -438,11 +445,11 @@ int ssps_bind_result(STMT *stmt)

                                                       IS_PS_OUT_PARAMS(stmt));

       stmt->result_bind[i].buffer_type  = p.type;

-	  stmt->result_bind[i].buffer       = p.buffer;

-	  stmt->result_bind[i].buffer_length= (unsigned long)p.size;

-	  stmt->result_bind[i].length       = &len[i];

-	  stmt->result_bind[i].is_null      = &is_null[i];

-	  stmt->result_bind[i].error        = &err[i];

+	    stmt->result_bind[i].buffer       = p.buffer;

+	    stmt->result_bind[i].buffer_length= (unsigned long)p.size;

+	    stmt->result_bind[i].length       = &len[i];

+	    stmt->result_bind[i].is_null      = &is_null[i];

+	    stmt->result_bind[i].error        = &err[i];

       stmt->result_bind[i].is_unsigned  = (field->flags & UNSIGNED_FLAG)? 1: 0;

       stmt->array[i]= p.buffer;

diff --git a/driver/my_stmt.c b/driver/my_stmt.c

index 0dd059f..6e201d5 100644

--- a/driver/my_stmt.c

+++ b/driver/my_stmt.c

@@ -44,7 +44,16 @@ BOOL returned_result(STMT *stmt)

   if (ssps_used(stmt))

   {

     /* Basically at this point we are supposed to get result already */

-    return stmt->result ? TRUE : mysql_stmt_result_metadata(stmt->ssps) != NULL;

+    MYSQL_RES *temp_res= NULL;

+

+    if ((stmt->result != NULL) || 

+        (temp_res= mysql_stmt_result_metadata(stmt->ssps)) != NULL)

+    {

+      /* mysql_free_result checks for NULL, so we can always call it */

+      mysql_free_result(temp_res);

+      return TRUE;

+    }

+    return FALSE;

   }

   else

   {

@@ -55,24 +64,18 @@ BOOL returned_result(STMT *stmt)

 my_bool free_current_result(STMT *stmt)

 {

+  my_bool res= 0;

   if (returned_result(stmt))

   {

     if (ssps_used(stmt))

- 

-    {

-      my_bool res= mysql_stmt_free_result(stmt->ssps);

-      stmt->result= NULL;

-

-      return res;

-    }

-    else

     {

-      mysql_free_result(stmt->result);

-      stmt->result= NULL;

-      return '\0';

+      res= mysql_stmt_free_result(stmt->ssps);

     }

+    /* We need to always free stmt->result because SSPS keep metadata there */

+    mysql_free_result(stmt->result);

+    stmt->result= NULL;

   }

-  return '\0';

+  return res;

 }

@@ -98,6 +101,9 @@ MYSQL_RES * stmt_get_result(STMT *stmt, BOOL force_use)

    we need to use/store each resultset of multiple resultsets */

 MYSQL_RES * get_result_metadata(STMT *stmt, BOOL force_use)

 {

+  /* just a precaution, mysql_free_result checks for NULL anywat */

+  mysql_free_result(stmt->result);

+

   if (ssps_used(stmt))

   {

     stmt->result= mysql_stmt_result_metadata(stmt->ssps);

@@ -399,6 +405,9 @@ SQLRETURN prepare(STMT *stmt, char * query, SQLINTEGER query_length)

       stmt->param_count= mysql_stmt_param_count(stmt->ssps);

+      /* make sure we free the result from the previous time */

+      mysql_free_result(stmt->result);

+

       /* Getting result metadata */

       if ((stmt->result= mysql_stmt_result_metadata(stmt->ssps)))

       {

-- 

2.13.3