cx_Oracle.connect segfaults when using python-ldap

[EricHorton]

cx_Oracle.connect segfaults when using LDAP directory services and python-ldap is imported.

To reproduce, configure a Python environment

python3 -m venv env/
. env/bin/activate
pip install cx-oracle==6.3.1 python-ldap==3.1.0

and try to establish a connection

import cx_Oracle
import ldap

cx_Oracle.connect(user='username', password='password', dsn='<dsn>')

The above exits immediately with Segmentation fault: 11. Note that <dsn> must be valid (it must exist and be discoverable from directory services), otherwise the module will exit normally, saying the connect identifier could not be resolved.

The error appears to be where Oracle searches for LDAP entries, passing a bad memory reference to ldap_first_entry. From the lldb backtrace:

$ lldb python
(lldb) target create "python"
Current executable set to 'python' (x86_64).
(lldb) run test.py

...

(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
  * frame #0: 0x00007fff586d6e6e LDAP`ldap_first_entry + 12
    frame #1: 0x000000010407c7d6 libclntsh.dylib`nnflgne + 3526
...

Relevant Questions

1. What is your version of Python? Is it 32-bit or 64-bit?

64-bit Python 3.6.5, installed via Homebrew with brew install python.

2. What is your version of cx_Oracle?

From pip freeze

cx-Oracle==6.3.1
pyasn1==0.4.3
pyasn1-modules==0.2.1
python-ldap==3.1.0

3. What is your version of the Oracle client (e.g. Instant Client)? How was it
   installed? Where is it installed?

Oracle Instant Client Basic 12.1, installed via Homebrew at /usr/local/Cellar/instantclient-basic/. Installation performed by manually downloading Instant Client .zip file, placing it in ~/Library/Caches/Homebrew, and running

brew tap InstantClientTap/instantclient
brew install instantclient-basic

4. What is your version of the Oracle Database?

N/A (issue occurs prior to connecting to a database)

5. What is your OS and version?

macOS 10.13.3

6. What compiler version did you use? For example, with GCC, run
   gcc --version.

Apple LLVM version 9.1.0 (clang-902.0.39.2)

7. What environment variables did you set? How exactly did you set them?

Shell startup script with

export ORACLE_HOME=/usr/local/Cellar/instantclient-sqlplus/12.2.0.1.0-2/

8. Other software versions.

OpenLDAP 2.4.

[anthony-tuininga]

There are apparently conflicts with OpenLDAP and the Oracle Client libraries. You can try running something with the ldap module first to see if that resolves the matter, or you can try using LD_PRELOAD to ensure that the OpenLDAP libraries are loaded first. If either of those works, let us know! Thanks.

[EricHorton]

Import order for ldap vs cx_Oracle appears to have no effect. However, preloading appears to fix the issue (I had to preload the Oracle Client libraries, not OpenLDAP). I ended up using the macOS specific DYLD_INSERT_LIBRARIES. I assume LD_PRELOAD will work on Linux. Here’s the final config:

DYLD_INSERT_LIBRARIES=<instantclient-path>/lib/libclntsh.dylib python test.py

This changes the normal load order (as reported by DYLD_PRINT_LIBRARIES=1) from

dyld: loaded: <virtualenv-path>/lib/python3.6/site-packages/cx_Oracle.cpython-36m-darwin.so
dyld: loaded: <virtualenv-path>/lib/python3.6/site-packages/_ldap.cpython-36m-darwin.so
dyld: loaded: /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
dyld: loaded: /usr/local/lib/libclntsh.dylib

to

dyld: loaded: /usr/local/lib/libclntsh.dylib
dyld: loaded: <virtualenv-path>/lib/python3.6/site-packages/cx_Oracle.cpython-36m-darwin.so
dyld: loaded: <virtualenv-path>/lib/python3.6/site-packages/_ldap.cpython-36m-darwin.so
dyld: loaded: /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP

Is there documentation regarding the conflict with OpenLDAP somewhere that I missed?

[anthony-tuininga]

I'm glad you got it working! I'm not aware of any documentation that discusses the conflict with OpenLDAP but the issue has come up before and @cjbj may be able to shed some additional light on the matter.

[cjbj]

There are some bugs logged against Oracle on this, but the problem could possibly be one of those intractable ones. Whatever the team looking after those libraries does, someone could be negatively impacted.

[EricHorton]

Normally I would open a pull request for documentation, but since this issue appears to be rooted in the interaction of the Instant Client and OpenLDAP libraries, I'm not sure the Python module is the correct place to put it.

Regardless, the issue was resolved on my end by applying configuration in #187 (comment).