SIGSEGV in SQLFetchScroll (libmsodbcsql.18) under concurrent threaded fetch on macOS arm64
Mantenedores costumam responder em até 2 dias
@bewithgaurav já está trabalhando nisso.
Desde 15/7/2026.
Avaliação
Esta issue ainda não foi avaliada.
Descrição
Summary
mssql-python 1.10.0 crashes with a SIGSEGV during concurrent multi-threaded fetching on macOS arm64. The process is killed by the signal with no Python traceback (exit 139). The macOS crash report puts the faulting frame inside libmsodbcsql.18.dylib at SQLFetchScroll, reached through the driver's ddbc_bindings (FetchBatchData / FetchMany_wrap).
This looks like the same underlying problem as #668 (TLS stream corruption under concurrent threaded reads on macOS arm64), but here the failure is a hard crash instead of corrupted rows or a link error, so I am reporting it separately with the native stack. More on that connection at the end.
Environment
- macOS 26.5.2 (build 25F84), Apple Silicon (arm64)
- Python 3.12.11
- mssql-python 1.10.0 (bundled
libmsodbcsql.18.dylib,ddbc_bindings.cp312-universal2.so) - SQLAlchemy 2.1.0b3,
mssql+mssqlpythondialect - Connection:
Encrypt=yes,TrustServerCertificate=yes, built-in connection pooling on, transaction isolation SNAPSHOT - Remote SQL Server, reached over a VPN
How it shows up
The workload is a dlt sql_database extract on the pyarrow backend. Eight worker threads read different tables at the same time, each running a SELECT and pulling rows with fetchmany. The crash lands during the fetch phase, early in a schema that has many tables loading concurrently. It is intermittent and happens under sustained concurrent reads, not on one specific row. A short synthetic stress script did not force it, which is in line with what others noted on #668.
Fault
EXC_BAD_ACCESS (SIGSEGV),KERN_INVALID_ADDRESS at 0x0000000000000008(a dereference through a near-null pointer).- At crash time, 6 of 29 threads were executing inside
libmsodbcsql.18.dyliband 2 were in a fetch call. That points at a race in the driver's read path under concurrency, not at bad input.
Native stack (crashing thread)
The interpreter side is a plain SQLAlchemy result iteration (_manyrow_getter, i.e. fetchmany) calling into the driver:
libmsodbcsql.18.dylib SQLFetchScroll <-- faulting frame
ddbc_bindings.cp312-universal2.so FetchBatchData(...)
ddbc_bindings.cp312-universal2.so FetchMany_wrap(...)
ddbc_bindings.cp312-universal2.so pybind11 dispatcher
libpython3.12.dylib _PyEval_EvalFrameDefault
_result_cy.cpython-312-darwin.so sqlalchemy BaseResultInternal _manyrow_getter
libpython3.12.dylib builtin_next
Full frames from the .ips crash report:
crashing thread, all frames
0 libmsodbcsql.18.dylib + 1127984
1 libmsodbcsql.18.dylib + 1171428
2 libmsodbcsql.18.dylib + 1199848
3 libmsodbcsql.18.dylib + 1140492
4 libmsodbcsql.18.dylib + 943376
5 libmsodbcsql.18.dylib + 859712
6 libmsodbcsql.18.dylib + 867548
7 libmsodbcsql.18.dylib + 905332
8 libmsodbcsql.18.dylib + 164368
9 libmsodbcsql.18.dylib + 450000
10 libmsodbcsql.18.dylib + 462896
11 libmsodbcsql.18.dylib + 463820 SQLFetchScroll
12 ddbc_bindings.cp312-universal2.so + 111852 FetchBatchData(...)
13 ddbc_bindings.cp312-universal2.so + 123228 FetchMany_wrap(...)
14 ddbc_bindings.cp312-universal2.so + 373200 pybind11 argument_loader::call
15 ddbc_bindings.cp312-universal2.so + 186332 pybind11::cpp_function::dispatcher
16 libpython3.12.dylib + 677576 _PyEval_EvalFrameDefault
17 _result_cy.cpython-312-darwin.so + 92288 sqlalchemy BaseResultInternal _manyrow_getter
18 libpython3.12.dylib + 2721008 gen_iternext
19 libpython3.12.dylib + 2918080 builtin_next
20 libpython3.12.dylib + 1906720 thread_run
21 libsystem_pthread.dylib + 27736 _pthread_start
22 libsystem_pthread.dylib + 7196 thread_start
Likely relation to #668
#668 reports concurrent threaded reads on macOS arm64 with Encrypt=yes corrupting the TDS/TLS stream: single-character substitutions in returned strings, Communication link failure, Protocol error in TDS stream, and timeouts. It reproduces with pyodbc plus msodbcsql18 too, so it lives in the ODBC/TLS layer. A commenter there suspects the read path is corrupting adjacent heap memory. A near-null dereference in SQLFetchScroll fits that reading: the same corruption, landing on a pointer rather than a data byte. Same trigger (macOS arm64, mssql-python 1.10.0, Encrypt=yes, concurrent reads), heavier outcome.
- Linguagem predominante
- Python
- Estrelas
- 478
- Forks
- 62
- Merge médio
- 3d 1h
- PRs com merge (30d)
- 26
Preparar o ambiente
Inicia o contêiner de desenvolvimento do projeto no navegador, com a sua própria conta do GitHub.
- Sem Dockerfile nem arquivo Docker Compose
- Tem um modelo de pull request
- Ler o guia de contribuição
Primeiros passos
- Leia a issue inteira e depois o guia de contribuição do projeto.
- Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
- Faça um fork do repositório e trabalhe em uma branch.
- Abra um pull request que referencie o número da issue.
Mais de microsoft/mssql-python
-
area: bulk-copy triage needed
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 70/100
microsoft/mssql-python#843 · 1 comentário ·
Mantenedores costumam responder em até 2 dias
-
triage needed
Dificuldade 4/5 3-5 dias Facilidade para iniciantes 22/100
microsoft/mssql-python#849 · 1 comentário ·
Mantenedores costumam responder em até 2 dias
-
triage needed
Dificuldade 4/5 3-5 dias Facilidade para iniciantes 20/100
microsoft/mssql-python#848 · 1 comentário ·
Mantenedores costumam responder em até 2 dias
-
triage needed
Dificuldade 4/5 3-5 dias Facilidade para iniciantes 35/100
microsoft/mssql-python#846 · 1 comentário ·
Mantenedores costumam responder em até 2 dias
-
macOS: encrypted connections fail after Homebrew moved the `openssl` alias to `openssl@4`Talvez já em andamento @bewithgaurav assumiu há 16 dias. Abertaarea: packaging-platform bug triage needed
Dificuldade 4/5 3-5 dias Facilidade para iniciantes 55/100
microsoft/mssql-python#826 · 2 comentários · 1 responsável ·
Mantenedores costumam responder em até 2 dias
Todas as issues de microsoft/mssql-python
Issues semelhantes
-
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 72/100
PolicyEngine/policyengine-us#10262 ·
Mantenedores costumam responder em até 2 dias
-
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 74/100
kellyjonbrazil/jc#788 ·
Mantenedores costumam responder em até 2 dias
-
bug
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 72/100
Mantenedores costumam responder em até 1 dia
-
`/search.json` ignores the documented `editions.sort` parameterTalvez já em andamento @PranavD2905 assumiu hoje. AbertaAffects: Server Good First Issue Module: Solr Needs: Triage Theme: Public APIs Theme: Search
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 74/100
internetarchive/openlibrary#13989 · 1 comentário ·
Mantenedores costumam responder em até 1 dia
-
bug P2: misleading query
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 62/100
jeffknupp/association#478 ·