FIX: AV on DECLARE CURSOR with Correlated Subquery and KEYSET or DYNAMIC Cursor Type (308881)

SYMPTOMS

SQL Server may encounter an access violation (AV) with a DECLARE CURSOR statement if the following conditions are true:

A SELECT statement has a correlated subquery.
The correlation is through an OR clause or IN clause.
The cursor type must be KEYSET or DYNAMIC.
There is a nonclustered primary key on both correlated tables.
The subquery table must not have an additional clustered index.

RESOLUTION

To resolve this problem, obtain the latest service pack for Microsoft SQL Server 7.0. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

301511 INF: How to Obtain the Latest SQL Server 7.0 Service Pack

NOTE: The following hotfix was created prior to Microsoft SQL Server 7.0 Service Pack 4.

The English version of this fix should have the following file attributes or later:

   Date         Time    Version      Size     File name
   -------------------------------------------------------

   27-SEP-2001  2:08    7.00.1010    4937KB   Sqlservr.exe

NOTE: Because of file dependencies, the most recent hotfix or feature that contains the preceding files may also contain additional files.

MORE INFORMATION

The following script illustrates the behavior:

---Create the tables
CREATE TABLE [dbo].[t1] (
 [id] [int] NOT NULL PRIMARY KEY NONCLUSTERED,
 [c1] [int] NOT NULL ,
 [c2] [int] NOT NULL ,
 [c3] [int] NOT NULL 
) 
GO
CREATE TABLE [dbo].[t2] ([id] [int] NOT NULL PRIMARY KEY NONCLUSTERED)
GO

---Execute the following to cause the AV
declare t cursor for
	 select (select sum(c3) from t1 where t2.id in (c1,c2)) 
          from t2
go

The short stack dump generated in the errorlog will contain the following functions:

(CSubRuleCrsFtchToUnionAllStrategy::BuildSubstitutes+f6)
(COptContext::PexprTransformTopLevel+199)
(COptContext::PexprNormalize+22)
(COptContext::PexprNormalize+a0)
(COptContext::PexprNormalize+a0)
(COptContext::PexprNormalize+a0)
(CMemo::NormalizeQuery+174)
(COptContext::PexprSearchPlan+bb)
(COptContext::PcxteOptimizeQuery+7eb)
(CQuery::Optimize+21f)
(CQuery::Prepare+92)
(CCvtTree::PqryFromTree+814)
(BuildQueryFromTree+61)
(CFetchKeyset::CompileQuery+60)
(CFetchKeyset::CompileSetFetchExp+321)
(CFetchKeyset::CompileKeysetExprs+18)
(CFetchKeyset::Compile+10f)
(CFetchComponent::smInitializeFetchComponent+fc)
(CCursorDeclareStmt::Init+286)
(CompileCursor+1f8)
(CCompPlan::FCompileStep+e79)
(CProchdr::FCompile+5d9)
(CSQLSource::FTransform+234)
(CSQLStrings::FTransform+159)
(CSQLSource::Execute+11d)
(language_exec+39c)
(execute_event+659)
(process_commands+f3)
(ProcessWorkRequests+ed)
(ThreadStartRoutine+139)
(beginthread+ce)
(CreateFileA+11b)