apache / apache/arrow-java

[FlightSQL] Statement.execute(String) can leak server prepared-statement handles when reused

Open
#1,129 0 comments 0 reactions 0 assignees View on GitHub
Type: bug
Dominant language
Java
Stars
94
Forks
152
Avg merge
3d 16h
Merged PRs (30d)
11

Description

### Describe the bug, including details regarding any error messages, version, and platform.

When reusing the same JDBC Statement and calling execute(String) multiple times, the Flight SQL JDBC path creates a new prepared statement on each call, but previous prepared handles are not closed before being replaced in client tracking state.

This means only the latest handle is guaranteed to be closed when the statement is closed. On stateful Flight SQL servers, this can leak server-side resources associated with older handles.

Repro
```
try (Connection connection = DriverManager.getConnection(jdbcUrl, properties);
Statement statement = connection.createStatement()) {

for (int i = 1; i <= n; i++) {
String sql = "SELECT " + i;
boolean isResultSet = statement.execute(sql);
if (isResultSet) {
try (ResultSet rs = statement.getResultSet()) {
while (rs.next()) { /* consume */ }
}
}
}
}
```

Raised in https://github.com/apache/arrow-java/pull/1090#discussion_r3132344585

Contributor guide

Open the contributing guide

Research direction

Start at the Flight SQL JDBC implementation of Statement.execute(String) and trace how prepared-statement handles are replaced and closed; the issue does not name a file or test. Reproduce the loop against a stateful Flight SQL server, then verify that each prior handle is released before the next is tracked and that Statement.close still cleans up the final handle.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.