[Bug 48111] New: myodbc-installer v5.x (part of Toad for MySQL Freeware 7.x) crashes when querying for installed drivers ('SQLGetInstalledDrivers' doesn't handle NULL 'sizeout')

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=48111

Bug ID: 48111
           Summary: myodbc-installer v5.x (part of Toad for MySQL Freeware
                    7.x) crashes when querying for installed drivers
                    ('SQLGetInstalledDrivers' doesn't handle NULL
                    'sizeout')
           Product: Wine
           Version: 4.20
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: odbc
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Hello folks,

as it says. The tool is part of Toad for MySQL Freeware 7.x installation.

Prerequisite: 'winetricks -q dotnet45'

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files (x86)/Quest Software/Toad for MySQL
Freeware 7.3/Plugins/MySQL/ODBC/bin

$ wine ./myodbc-installer.exe 
[ERROR] Not enough arguments given
+---                                                                   
| myodbc-installer v5.01.0012                                 
+---                                                                   
|                                                                      
| Description                                                          
|                                                                      
|    This program can be used to create, edit or remove a DSN. It      
|    can also be used to register or deregister a driver. In other     
|    words - it can be used to manage ODBC system information.         
|                                                                      
|    This operates consistently across platforms. This has been created
|    specifically for MySQL Connector/ODBC.                            
|                                                                      
| Syntax                                                               
|                                                                      
|    myodbc-installer <Object> <Action> [Options]                      
|                                                                      
| Object                                                               
|                                                                      
|     -d driver                                                        
|     -s datasource                                                    
|                                                                      
| Action                                                               
|                                                                      
|     -l list                                                          
|     -a add (add/update for data source)                              
|     -r remove                                                        
|                                                                      
| Options                                                              
|                                                                      
|     -n <name>                                                        
|     -t <attribute string>                                            
|     -c0 both                                                         
|     -c1 user data source                                             
|     -c2 system data source (default)                                 
|                                                                      
| Examples                                                             
|                                                                      
|    List drivers                                                      
|        -d -l                                                         
|                                                                      
|    Register a driver (UNIX example)                                  
|        -d -a -n "MySQL ODBC 5.1 Driver" \                         
|              -t "DRIVER=/usr/lib/myodbc5.so;SETUP=/usr/lib/myodbc3S.so"
|                                                                      
|    Register a driver (Windows example)                               
|        -d -a -n "MySQL ODBC 5.1 Driver" \                         
|              -t "DRIVER=myodbc5.dll;SETUP=myodbc5S.dll"            
|                                                                      
|    Add a new data source name                                        
|        -s -a -c2 -n "test" \                                      
|              -t "DRIVER=MySQL ODBC 5.1
Driver;SERVER=localhost;DATABASE=test;UID=myid;PWD=mypwd"
|                                                                      
|    List data source name attributes for 'test'                       
|        -s -l -c2 -n "test"                                         
+---    
...
--- snip ---

--- snip ---
$ WINEDEBUG=+seh,+relay wine ./myodbc-installer.exe -d -l >>log.txt 2>&1
...
002d:Ret  KERNEL32.LoadLibraryA() retval=6f280000 ret=0040623c
002d:Call KERNEL32.LoadLibraryA(0119f76c "C:\windows\system32\odbccp32.dll")
ret=00406247 
...
002d:Call odbccp32.SQLGetConfigMode(0119fecc) ret=004024aa
...
002d:Ret  odbccp32.SQLGetConfigMode() retval=00000001 ret=004024aa
...
002d:Call odbccp32.SQLSetConfigMode(00000002) ret=004024c3
002d:Ret  odbccp32.SQLSetConfigMode() retval=00000001 ret=004024c3 
...
002d:Call odbccp32.SQLGetInstalledDrivers(01193b88,0000c350,00000000)
ret=004013ac
002d:Call ntdll.RtlAllocateHeap(00110000,00000000,000186a0) ret=6f284207
002d:Ret  ntdll.RtlAllocateHeap() retval=0015be38 ret=6f284207
002d:Call advapi32.RegOpenKeyExW(80000002,6f28cae0
L"Software\ODBC\ODBCINST.INI\ODBC Drivers",00000000,00000001,01193ab8)
ret=6f283e42
002d:Call ntdll.RtlInitUnicodeString(01193a10,6f28cae0
L"Software\ODBC\ODBCINST.INI\ODBC Drivers") ret=7127823b
002d:Ret  ntdll.RtlInitUnicodeString() retval=00000050 ret=7127823b
002d:Call ntdll.NtOpenKeyEx(01193ab8,00000001,01193a18,00000000) ret=7127826f
002d:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7127826f
002d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7127827b
002d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7127827b
002d:Ret  advapi32.RegOpenKeyExW() retval=00000000 ret=6f283e42
002d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000200) ret=6f283f36
002d:Ret  ntdll.RtlAllocateHeap() retval=00156b28 ret=6f283f36
002d:Call
advapi32.RegEnumValueW(00000050,00000000,00156b28,01193abc,00000000,00000000,00000000,00000000)
ret=6f283f95
002d:Call
ntdll.NtEnumerateValueKey(00000050,00000000,00000001,01193910,00000100,0119390c)
ret=7127718b
002d:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7127718b
002d:Call ntdll.memcpy(00156b28,01193924,0000000e) ret=71277328
002d:Ret  ntdll.memcpy() retval=00156b28 ret=71277328
002d:Call ntdll.RtlNtStatusToDosError(00000000) ret=712772b8
002d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=712772b8
002d:Ret  advapi32.RegEnumValueW() retval=00000000 ret=6f283f95
002d:Call
advapi32.RegEnumValueW(00000050,00000001,00156b28,01193abc,00000000,00000000,00000000,00000000)
ret=6f283f95
002d:Call
ntdll.NtEnumerateValueKey(00000050,00000001,00000001,01193910,00000100,0119390c)
ret=7127718b
002d:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7127718b
002d:Call ntdll.memcpy(00156b28,01193924,0000000e) ret=71277328
002d:Ret  ntdll.memcpy() retval=00156b28 ret=71277328
002d:Call ntdll.RtlNtStatusToDosError(00000000) ret=712772b8
002d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=712772b8
002d:Ret  advapi32.RegEnumValueW() retval=00000000 ret=6f283f95
002d:Call
advapi32.RegEnumValueW(00000050,00000002,00156b28,01193abc,00000000,00000000,00000000,00000000)
ret=6f283f95
002d:Call
ntdll.NtEnumerateValueKey(00000050,00000002,00000001,01193910,00000100,0119390c)
ret=7127718b
002d:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7127718b
002d:Call ntdll.memcpy(00156b28,01193924,0000000a) ret=71277328
002d:Ret  ntdll.memcpy() retval=00156b28 ret=71277328
002d:Call ntdll.RtlNtStatusToDosError(00000000) ret=712772b8
002d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=712772b8
002d:Ret  advapi32.RegEnumValueW() retval=00000000 ret=6f283f95
002d:Call
advapi32.RegEnumValueW(00000050,00000003,00156b28,01193abc,00000000,00000000,00000000,00000000)
ret=6f283f95
002d:Call
ntdll.NtEnumerateValueKey(00000050,00000003,00000001,01193910,00000100,0119390c)
ret=7127718b
002d:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7127718b
002d:Call ntdll.memcpy(00156b28,01193924,0000002a) ret=71277328
002d:Ret  ntdll.memcpy() retval=00156b28 ret=71277328
002d:Call ntdll.RtlNtStatusToDosError(00000000) ret=712772b8
002d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=712772b8
002d:Ret  advapi32.RegEnumValueW() retval=00000000 ret=6f283f95
002d:Call
advapi32.RegEnumValueW(00000050,00000004,00156b28,01193abc,00000000,00000000,00000000,00000000)
ret=6f283f95
002d:Call
ntdll.NtEnumerateValueKey(00000050,00000004,00000001,01193910,00000100,0119390c)
ret=7127718b
002d:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7127718b
002d:Call ntdll.memcpy(00156b28,01193924,00000014) ret=71277328
002d:Ret  ntdll.memcpy() retval=00156b28 ret=71277328
002d:Call ntdll.RtlNtStatusToDosError(00000000) ret=712772b8
002d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=712772b8
002d:Ret  advapi32.RegEnumValueW() retval=00000000 ret=6f283f95
002d:Call
advapi32.RegEnumValueW(00000050,00000005,00156b28,01193abc,00000000,00000000,00000000,00000000)
ret=6f283f95
002d:Call
ntdll.NtEnumerateValueKey(00000050,00000005,00000001,01193910,00000100,0119390c)
ret=7127718b
002d:Ret  ntdll.NtEnumerateValueKey() retval=8000001a ret=7127718b
002d:Call ntdll.RtlNtStatusToDosError(8000001a) ret=712772b8
002d:Ret  ntdll.RtlNtStatusToDosError() retval=00000103 ret=712772b8
002d:Ret  advapi32.RegEnumValueW() retval=00000103 ret=6f283f95
002d:Call KERNEL32.HeapFree(00110000,00000000,00156b28) ret=6f2840fd
002d:Ret  KERNEL32.HeapFree() retval=00000001 ret=6f2840fd
002d:Call advapi32.RegCloseKey(00000050) ret=6f28410b
002d:Call ntdll.NtClose(00000050) ret=71276114
002d:Ret  ntdll.NtClose() retval=00000000 ret=71276114
002d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7bc9a6b4
002d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7bc9a6b4
002d:Ret  advapi32.RegCloseKey() retval=00000000 ret=6f28410b
002d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0015be38
L"FreeTDS",00000038,00000000,00000000,00000000,00000000) ret=6f284275
002d:Ret  KERNEL32.WideCharToMultiByte() retval=00000038 ret=6f284275
002d:trace:seh:raise_exception code=c0000005 flags=0 addr=0x6f28427b
ip=6f28427b tid=002d
002d:trace:seh:raise_exception  info[0]=00000001
002d:trace:seh:raise_exception  info[1]=00000000
002d:trace:seh:raise_exception  eax=00000038 ebx=0000c350 ecx=00000000
edx=00000000 esi=0015be38 edi=7ffd8000
002d:trace:seh:raise_exception  ebp=01193b38 esp=01193ae0 cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00010202
002d:trace:seh:call_stack_handlers calling handler at 0x42b630 code=c0000005
flags=0
002d:Call KERNEL32.GetLastError() ret=0042cb2b 
--- snip ---

The unicode variant respects the NULL out parameter - the ANSI variant not.

Wine source:

https://source.winehq.org/git/wine.git/blob/8df456ccd4ce1c2c42e5a24c71a8c3eb...

--- snip ---
 558 BOOL WINAPI SQLGetInstalledDrivers(char *buf, WORD size, WORD *sizeout)
 559 {
 560     WORD written;
 561     WCHAR *wbuf;
 562     BOOL ret;
 563 
 564     TRACE("%p %d %p\n", buf, size, sizeout);
 565 
 566     if (!buf || !size)
 567     {
 568         push_error(ODBC_ERROR_INVALID_BUFF_LEN,
odbc_error_invalid_buff_len);
 569         return FALSE;
 570     }
 571 
 572     wbuf = heap_alloc(size * sizeof(WCHAR));
 573     if (!wbuf)
 574     {
 575         push_error(ODBC_ERROR_OUT_OF_MEM, odbc_error_out_of_mem);
 576         return FALSE;
 577     }
 578 
 579     ret = SQLGetInstalledDriversW(wbuf, size, &written);
 580     if (!ret)
 581     {
 582         heap_free(wbuf);
 583         return FALSE;
 584     }
 585 
 586     *sizeout = WideCharToMultiByte(CP_ACP, 0, wbuf, written, NULL, 0,
NULL, NULL);
 587     WideCharToMultiByte(CP_ACP, 0, wbuf, written, buf, size, NULL, NULL);
 588 
 589     heap_free(wbuf);
 590     return TRUE;
 591 }
--- snip ---

Microsoft docs:

https://docs.microsoft.com/en-us/sql/odbc/reference/syntax/sqlgetinstalleddr...

--- quote ---
pcbBufOut

[Output] Total number of bytes (excluding the null-termination byte) returned
in lpszBuf. If the number of bytes available to return is greater than or equal
to cbBufMax, the list of driver descriptions in lpszBuf is truncated to
cbBufMax minus the null-termination character. The pcbBufOut argument can be a
null pointer.
--- quote ---

Download:

https://web.archive.org/web/20191116093038/https://files.downloadnow.com/s/s...

$ sha1sum ToadforMySQL_Freeware_7.3.1.3290.*
8afd76a00c1ebb538230bb11036471778af5c2a6  ToadforMySQL_Freeware_7.3.1.3290.exe
29c1bd74b1e9133a9f9cacdd2b25244bdab38d4a  ToadforMySQL_Freeware_7.3.1.3290.zip

$ du -sh ToadforMySQL_Freeware_7.3.1.3290.*
80M    ToadforMySQL_Freeware_7.3.1.3290.exe
80M    ToadforMySQL_Freeware_7.3.1.3290.zip

$ wine --version
wine-4.20

Regards