Segfault (SIGSEGV) in thin-mode fetch_df_all/fetch_df_batches when a result column has undefined length (internal_size = None)

[vucenovic]

1. What versions are you using?

python-oracledb version: 4.0.1

Thin or Thick mode: Thin

Python version and platform:

platform.platform: Linux-6.18.33.2-microsoft-standard-WSL2-x86_64-with-glibc2.39
sys.maxsize > 2**32: True
platform.python_version: 3.12.3
oracledb.version: 4.0.1

Oracle Database version: 19.19.0.0.0 (Thin mode; clientversion() N/A)

2. Is it an error or a hang or a crash?

Crash

3. What error(s) or behavior you are seeing?

In Thin mode, Connection.fetch_df_all() / Connection.fetch_df_batches() crashes the interpreter with a segmentation fault when the result set contains a VARCHAR column of undefined length (reported as internal_size = None / display_size = None in cursor.description) and 3 or more rows are returned.

With ≤ 2 rows it does not crash.
If the column has a defined length (e.g. CAST(NULL AS VARCHAR2(10))) it does not crash at any row count.
Fetching the same query the ordinary way (cursor.execute() + fetchall()) works fine and returns the values.
Occurs with and without a requested_schema argument.

4. Does your application call init_oracle_client()?

No

5. Include a runnable Python script that shows the problem.

import oracledb, faulthandler
faulthandler.enable()

conn = oracledb.connect(user="...", password="...", dsn="host:1521/service")  # thin mode

# describe: c -> DB_TYPE_VARCHAR, internal_size=None, display_size=None
cur = conn.cursor()
cur.execute("SELECT NULL AS c FROM dual CONNECT BY LEVEL <= 3")
print(cur.description)
print(cur.fetchall())   # works: [(None,), (None,), (None,)]

# SIGSEGV (process exits 139):
conn.fetch_df_all("SELECT NULL AS c FROM dual CONNECT BY LEVEL <= 3")

[anthony-tuininga]

I was able to replicate your issue and the problem is that when a column is null by describe, a different code path was being followed, and the Arrow array was not being populated! So when the database server indicated that the next rows were the same as the last rows and the driver attempted to copy the last row that was populated, it failed. :-( I'll get this fixed shortly. Thanks for reporting it!

[anthony-tuininga]

I have pushed a patch that should correct this issue and have initated a build from which you can download pre-built development wheels once it completes. You can also build from source if you prefer. If you can test your scenario and confirm the patch works as expected, that would be appreciated!