DBD::Oracle: Crash in object support code

One of my production jobs, which uses Oracle objects, crashed
a couple of days ago. The error was an invalid free() detected
by glibc. Glibc produced a useful backtrace, which I have pasted
below (after my signature).

I have had a look at empty_oci_object(), and I am suspicious about
an if-block that comes right at the end of  the function. It says

        if (fld && fld->value && (SvTYPE(fld->value) == SVt_PVAV) ){
                        av_clear(obj->value);
                av_undef(obj->value);
        }

This doesn't look right to me. I don't understand why the tests
are on fld, when the actions are on obj.

As an emergency fix, I have removed these four lines of code.
This has got my production work going again. I have probably
introduced a store drain, but the jobs in question do not handle
large amounts of data. A store drain is better that a crash.

John, does this give you enough to allow you to spot the bug?

-- 
Charles Jardine - Computing Service, University of Cambridge
[email protected]    Tel: +44 1223 334506, Fax: +44 1223 334679

*** glibc detected *** /usr/local/bin/perl: free(): invalid size: 0x0000000000968500 ***
======= Backtrace: =========
/lib64/libc.so.6[0x2b2b9439c77e]
/lib64/libc.so.6(__libc_free+0x6c)[0x2b2b9439ddfc]
/usr/local/perl/5.10.1-F/lib/5.10.1/x86_64-linux-thread-multi/CORE/libperl.so(Perl_av_undef+0x69)[0x2b2b93a9e9a9]
/oracle/base/orahome/10.2.0.5.2/PERL/5.10.1-F/lib/auto/DBD/Oracle/Oracle.so(empty_oci_object+0x127)[0x2b2b949e75d7]
/oracle/base/orahome/10.2.0.5.2/PERL/5.10.1-F/lib/auto/DBD/Oracle/Oracle.so[0x2b2b949e7622]
/oracle/base/orahome/10.2.0.5.2/PERL/5.10.1-F/lib/auto/DBD/Oracle/Oracle.so(ora_st_fetch+0x85)[0x2b2b949ec0c5]
/oracle/base/orahome/10.2.0.5.2/PERL/5.10.1-F/lib/auto/DBD/Oracle/Oracle.so(XS_DBD__Oracle__st_fetchrow_arrayref+0x9a)[0x2b2b949cfc6a]
/usr/local/perl/5.10.1-F/lib/site_perl/5.10.1/x86_64-linux-thread-multi/auto/DBI/DBI.so(XS_DBI_dispatch+0x2145)[0x2b2b9458b5b5]
/usr/local/perl/5.10.1-F/lib/5.10.1/x86_64-linux-thread-multi/CORE/libperl.so(Perl_pp_entersub+0x599)[0x2b2b93aa0e99]
/usr/local/perl/5.10.1-F/lib/5.10.1/x86_64-linux-thread-multi/CORE/libperl.so(Perl_runops_standard+0xe)[0x2b2b93a9f43e]
/usr/local/perl/5.10.1-F/lib/5.10.1/x86_64-linux-thread-multi/CORE/libperl.so(Perl_call_sv+0x16f)[0x2b2b93a4712f]
/usr/local/perl/5.10.1-F/lib/site_perl/5.10.1/x86_64-linux-thread-multi/auto/DBI/DBI.so(XS_DBD_____st_fetchrow_hashref+0x1a1)[0x2b2b94580eb1]
/usr/local/perl/5.10.1-F/lib/site_perl/5.10.1/x86_64-linux-thread-multi/auto/DBI/DBI.so(XS_DBI_dispatch+0x2145)[0x2b2b9458b5b5]
/usr/local/perl/5.10.1-F/lib/5.10.1/x86_64-linux-thread-multi/CORE/libperl.so(Perl_pp_entersub+0x599)[0x2b2b93aa0e99]
/usr/local/perl/5.10.1-F/lib/5.10.1/x86_64-linux-thread-multi/CORE/libperl.so(Perl_runops_standard+0xe)[0x2b2b93a9f43e]
/usr/local/perl/5.10.1-F/lib/5.10.1/x86_64-linux-thread-multi/CORE/libperl.so(perl_run+0x307)[0x2b2b93a47e97]
/usr/local/bin/perl(main+0xdc)[0x400d2c]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x2b2b9434e304]
/usr/local/bin/perl[0x400bb9]