Signed integer overflow in DPI_ORACLE_VERSION_TO_NUMBER macro with Oracle Client 23c

[namitkewat]

1. What version of ODPI-C are you using (see dpi.h)?

v5.6.4

2. What OS (and version) is your application on?

Ubuntu 25.10 (Questing Quokka) (running as a VS Code Dev Container)

3. What compiler (and version) did you use?

Zig 0.15.2 (using zig cc, which maps to Clang 20.1.2) with musl libc.

4. What is your version of the Oracle Client (e.g. Instant Client)? How was it installed? Where it is installed?

Oracle Instant Client Basic Lite 23.26.0.0.0 (Linux x64)

• Installation: Unzipped manually.
• Location: /workspaces/my_project/local/instantclient_23_26 (project-local directory).

5. What is your Oracle Database version?

Oracle AI Database 26ai Free Release 23.26.0.0.0
(Output from SELECT banner_full FROM v$version;)

6. What is the PATH environment variable (on Windows) or LD_LIBRARY_PATH (on Linux) set to?

The library path is configured via /etc/ld.so.conf.d/oracle-project-local.conf pointing to the installation directory above.

7. What environment variables did you set? How exactly did you set them?

export ORACLE_HOME=/workspaces/my_project/local/instantclient_23_26
export PATH=$PATH:$ORACLE_HOME

8. What problem or error(s) you are seeing?

I encountered a signed integer overflow panic when initializing ODPI-C with Oracle Client 23c.

The issue is located in the DPI_ORACLE_VERSION_TO_NUMBER macro in include/dpi.h. When loading the Oracle 23c library, the major version (versionNum) is 23. The macro performs the calculation:
versionNum * 100000000

Since 100000000 is a signed integer literal and versionNum is an int, the operation is performed as signed 32-bit arithmetic:
23 * 100,000,000 = 2,300,000,000

This result exceeds INT_MAX (2,147,483,647), causing undefined behavior.

Runtime Error Log:

runtime error: signed integer overflow: 23 * 100000000 cannot be represented in type 'int'

9. Do you have a runnable code snippet to describe the problem?

This issue is reproducible by simply initializing the library with Oracle Client 23c present, using any compiler with UBSan enabled.

Suggested Fix:
Cast the multiplier constant to unsigned long long to ensure 64-bit arithmetic is used.

Diff for include/dpi.h:

- #define DPI_ORACLE_VERSION_TO_NUMBER(versionNum, releaseNum, updateNum, \
-                 portReleaseNum, portUpdateNum) \
-         ((versionNum * 100000000) + (releaseNum * 1000000) + \
-                 (updateNum * 10000) + (portReleaseNum * 100) + (portUpdateNum))

+ #define DPI_ORACLE_VERSION_TO_NUMBER(versionNum, releaseNum, updateNum, \
+                 portReleaseNum, portUpdateNum) \
+         ((versionNum * 100000000ULL) + (releaseNum * 1000000) + \
+                 (updateNum * 10000) + (portReleaseNum * 100) + (portUpdateNum))

[anthony-tuininga]

Thanks for the report! This will be included in an upcoming release of ODPI-C.