Server crashes when isc_dql_exec_immed3_m() is called for "create database ..." and NULL transaction [CORE3109]

[firebird-automations]

Submitted by: @ibprovider

Hi

SuperClassic Win64 [build 26054]

When I try to execute "create database '' user '' password '' default character set win1251" through isc_dsql_exec_immed3_m for newly created database (after isc_create_database) and without transaction, I get the AV in server process.

//-- [client code]
t_isc_api::isc_tr_handle tr_handle=NULL;

if(connection->m_provider->m_isc_dsql_exec_immed3_m.point()
(sv.reset(),
connection->get_handle_ptr(),
&tr_handle,
0,
"create database '' user '' password '' default character set win1251",
static_cast<t_isc_api::isc_ushort>(cns.client_dialect),
/*in_blr_length*/ 0,
/*in_blr*/ NULL,
/*in_msg_type*/ 0,
/*in_msg_length*/ 0,
/*in_msg*/ NULL,
/*out_blr_length*/ 0,
/*out_blr*/ NULL,
/*out_msg_type*/ 0,
/*out_msg_length*/ 0,
/*out_msg*/ NULL
))
{
//....
}

//----------- [Server Stack]
> fb_inet_server.exe!VIO_start_save_point(Jrd::thread_db * tdbb=0x0000000001d18068, Jrd::jrd_tra * transaction=0x0000000001d18068) Строка 2600 C++
fb_inet_server.exe!DYN_ddl(Jrd::jrd_tra * transaction=0x0000000000000000, unsigned short length=0x0000, const unsigned char * ddl=0x0000000001d18069) Строка 288 C++
fb_inet_server.exe!JRD_ddl(Jrd::thread_db * tdbb=0x0000000001520020, Jrd::jrd_tra * transaction=0x0000000001520020, unsigned short ddl_length=0x7ff0, const unsigned char * ddl=0x0000000001520020) Строка 6309 C++
fb_inet_server.exe!execute_request(Jrd::thread_db * tdbb=0x0000000001520044, Jrd::dsql_req * request=0x0000000001520044, Jrd::jrd_tra * * tra_handle=0x0000000001527210, unsigned short in_blr_length=0x001b, const unsigned char * in_blr=0x0000000000000000, unsigned short in_msg_length=0x0000, const unsigned char * in_msg=0x0000000000000000, unsigned short out_blr_length=0x0000, unsigned char * out_blr=0x0000000000000000, unsigned short out_msg_length=0x0000, unsigned char * out_msg=0x0000000000000000, bool singleton=false) Строка 1227 C++
fb_inet_server.exe!execute_immediate(Jrd::thread_db * tdbb=0x0000000003a8efc0, Jrd::Attachment * attachment=0x0000000001527210, Jrd::jrd_tra * * tra_handle=0x0000000003a8f210, unsigned short length=0x0008, const char * string=0x0000000001d18000, unsigned short dialect=0x000c, unsigned short in_blr_length=0x0000, const unsigned char * in_blr=0x0000000000000000, unsigned short in_msg_length=0x0000, const unsigned char * in_msg=0x0000000000000000, unsigned short out_blr_length=0x0000, unsigned char * out_blr=0x0000000000000000, unsigned short out_msg_length=0x0000, unsigned char * out_msg=0x0000000000000000) Строка 1150 C++
fb_inet_server.exe!DSQL_execute_immediate(Jrd::thread_db * tdbb=0x0000000001520020, Jrd::Attachment * attachment=0x0000000000000000, Jrd::jrd_tra * * tra_handle=0x0000000001520020, unsigned short length=0xf910, const char * string=0x0000000000f39648, unsigned short dialect=0x000c, unsigned short in_blr_length=0x0000, const unsigned char * in_blr=0x0000000000000000, unsigned short in_msg_length=0x0000, const unsigned char * in_msg=0x0000000000000000, unsigned short out_blr_length=0x0000, unsigned char * out_blr=0x0000000000000000, unsigned short out_msg_length=0x0000, unsigned char * out_msg=0x0000000000000000) Строка 330 C++
fb_inet_server.exe!jrd8_execute_immediate(__int64 * user_status=0x0000000003a8f2b0, Jrd::Attachment * * db_handle=0x0000000000000000, Jrd::jrd_tra * * tra_handle=0x0000000000000000, unsigned short length=0xf290, const char * string=0x0000000000f39648, unsigned short dialect=0x000c, unsigned short in_blr_length=0x0000, const char * in_blr=0x0000000000000000, unsigned short __formal=0x0000, unsigned short in_msg_length=0x0000, const char * in_msg=0x0000000000000000, unsigned short out_blr_length=0x0000, char * out_blr=0x0000000000000000, unsigned short __formal=0x0000, unsigned short out_msg_length=0x0000, char * out_msg=0x0000000000000000) Строка 3777 + 0x99 байт C++
fb_inet_server.exe!isc_dsql_exec_immed3_m(__int64 * user_status=0x0000000000000000, unsigned int * db_handle=0x0000000000000000, unsigned int * tra_handle=0x0000000003a8f290, unsigned short length=0xee68, const char * string=0x0000000000f39648, unsigned short dialect=0x000c, unsigned short in_blr_length=0x0000, char * in_blr=0x0000000000000000, unsigned short in_msg_type=0x0000, unsigned short in_msg_length=0x0000, const char * in_msg=0x0000000000000000, unsigned short out_blr_length=0x0000, char * out_blr=0x0000000000000000, unsigned short out_msg_type=0x0000, unsigned short out_msg_length=0x0000, char * out_msg=0x0000000000000000) Строка 3065 C++
fb_inet_server.exe!rem_port::execute_immediate(P_OP op=op_exec_immediate, p_sqlst * exnow=0x0000000003a8fe90, packet * sendL=0x0000000140238b55) Строка 2162 C++
fb_inet_server.exe!process_packet(rem_port * port=0x000000000060ee68, packet * sendL=0x0000000003a8fa60, packet * receive=0x0000000003a8f650, rem_port * * result=0x0000000003a8fe90) Строка 3474 C++
fb_inet_server.exe!SRVR_main(rem_port * main_port=0x00000000004a0020, unsigned short flags=0x0000) Строка 398 + 0x20 байт C++
fb_inet_server.exe!process_connection_thread(void * arg=0x000000000060e900) Строка 348 + 0x5 байт C++
fb_inet_server.exe!`anonymous namespace'::threadStart(void * arg=0x0000000000000000) Строка 139 + 0x5 байт C++

Commits: 8e4aae8 8875978

[firebird-automations]

Modified by: @asfernandes

status: Open [ 1 ] => Resolved [ 5 ]

resolution: Fixed [ 1 ]

Fix Version: 2.5.0 [ 10221 ]

Fix Version: 3.0 Alpha 1 [ 10331 ]

assignee: Adriano dos Santos Fernandes [ asfernandes ]

[firebird-automations]

Modified by: @dyemanov

summary: [Crash Test] isc_dql_exec_immed3_m for "create database ..." and NULL transaction => Server crashes when isc_dql_exec_immed3_m() is called for "create database ..." and NULL transaction

[firebird-automations]

Modified by: @pcisar

status: Resolved [ 5 ] => Closed [ 6 ]

[firebird-automations]

Modified by: @pavel-zotov

QA Status: No test