odbc: fix heap-use-after-free on the FOR UPDATE cursor path

[lemenkov]

Bug

exec_core (src/odbc/exec.c) handles updatable cursors by rewriting the SELECT (appending ROWIDTOCHAR(ROWID), and FOR UPDATE for SQL_CONCUR_LOCK) into a fresh heap buffer, then aliasing the local sql pointer onto it:

rewritten = seer_sql_make_updatable(sql, &tbl, ...);
if (rewritten != NULL) { sql = rewritten; ... }
...
st = seer_stmt_prepare(s->dbc->conn, sql, &s->core);
free(rewritten);                 // <-- freed here
...
int nmarkers = seer_sql_count_params(sql);   // <-- but sql still aliases it: use-after-free

seer_stmt_prepare copies the SQL, so freeing the buffer is fine in principle — but sql still points at it, and seer_sql_count_params(sql) reads the freed memory. AddressSanitizer aborts on the live SQL_CONCUR_LOCK path.

Fix

Defer free(rewritten) until after the last read of sql (the count_params call), covering both the data-at-exec and normal exit paths, and free separately on the seer_stmt_prepare error return. No path reads sql after the free.

Verified

Built with AddressSanitizer (detect_leaks=1:abort_on_error=1) and run against live Oracle 11g XE:

• FOR UPDATE (SQL_CONCUR_LOCK) — PASS, no use-after-free report
• Full integration suite: 40 pass / 0 fail / 11 skip (skips are expected 11g feature gaps)

🤖 Generated with Claude Code