Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Invalid access tokens crash ODBC driver - need defensive validation

未关闭
  • 哪里不对？
#278 2 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@bewithgaurav 已经在做这个了。

开始于 2025年10月6日。

  • #279 来自 @bewithgaurav —— 已关闭，未合并

评估

这个 Issue 还没有评估数据。

描述

area: connectivity-auth bug triage done
Describe the bug

The ODBC driver crashes with segmentation fault (macOS) or access violation (Windows) when SQL_COPT_SS_ACCESS_TOKEN (attribute 1256) is set with invalid token data via attrs_before parameter. The driver does not handle these cases gracefully, causing the Python process to crash.

This is replicable in pyodbc as well, indicating it's an underlying ODBC driver bug that we need to defend against.

Exception details:

macOS:

2025-10-06 16:00:07,377 - DEBUG - connection.py - [DDBC Bindings log] Connection string buffer created
zsh: segmentation fault  python main.py

Windows:

Windows fatal exception: access violation

Current thread 0x000029c8 (most recent call first):
  File "mssql_python\connection.py", line 203 in __init__
  File "mssql_python\db_connection.py", line 36 in connect
  File "main.py", line 22 in <module>

Stack trace shows crash originates in SQLDriverConnectW inside libmsodbcsql.18.dylib:

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   libsystem_platform.dylib      	0x1819e5320 _platform_memmove + 96
1   libmsodbcsql.18.dylib         	0x101220000 0x101168000 + 753664
...
11  libmsodbcsql.18.dylib         	0x1011c89ac SQLDriverConnectW + 2620
12  ddbc_bindings.cp313-universal2.so	0x10148c834 Connection::connect(pybind11::dict const&) + 528
To reproduce

Crash scenarios (connection string has no UID/PWD):

from mssql_python import connect

conn_str = "Driver={ODBC Driver 18 for SQL Server};Server=tcp:server.database.windows.net,1433;Database=testdb;"

# macOS: Crashes with tokens < 32 bytes
# Windows: Crashes with tokens >= 16 bytes
attrs_before = {1256: b"a" * 16} 
conn = connect(conn_str, attrs_before=attrs_before)

# macOS: 32 byte token works, but further larger tokens crash
# Windows: Any token >= 16 bytes crash
attrs_before = {1256: b"x" * 64}  # 64 bytes of invalid data - crashes on macOS
conn = connect(conn_str, attrs_before=attrs_before)

Platform-specific crash thresholds:

  • Windows: Crashes with binary tokens with length > 15
  • macOS: Crashes with binary tokens where length < 32, and also with longer malformed tokens (e.g., 64 bytes)
Expected behavior

The library should validate access token format and provide a clear error message before passing invalid data to the ODBC driver:

# Should raise a clear exception like:
# ValueError: Invalid access token format. Expected properly formatted OAuth 2.0 token.
# or
# TypeError: Access token must be bytes, not str

Rather than crashing the Python interpreter with segfault/access violation.

Further technical details

Python version: 3.13
ODBC Driver: Microsoft ODBC Driver 18 for SQL Server
Operating systems:

  • macOS (segmentation fault)
  • Windows (access violation)

Additional context

  • This issue is also reproducible in pyodbc for some scenarios, confirming it's an ODBC driver bug
  • ODBC documentation states tokens should be formatted with zero-byte padding (UCS-2 style), but doesn't specify minimum length
  • The library should implement defensive validation to prevent these crashes and provide helpful error messages
主要语言
Python
星标
479
派生
62
平均合并
2 天 23 小时
30 天内合并 PR
18

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/mssql-python 的其他 Issue

查看 microsoft/mssql-python 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。