With a table containing a VARCHAR2(4000) column containing data of a particular length, when executing “SELECT AP_FORWARD_DATA”, the driver hits a query timeout. 
Server version 12.1.0.2.0(CP838) with japanese charset.

If queryTimeout is not set, the driver keeps listening to server socket to read data. This is happening due to processing of server response incorrectly in only 1 scenario where result set contains character column with length of exactly 509 bytes.

When character column data is not (255*N+254) bytes, this issue will not occur, because control will not enter a bad logic area in the code; pasted below.

Analysis:

Below is server response for that character column(AP_FORWARD_DATA).

02 6b 00 00 06 00 00 00 00 00 06 22 01 01 00 01 

1d 00 00 00 07 fe ff 31 31 31…(255 bytes) fe 31 31 31…(254 bytes) 00 04. ------------------(255 + 254 = 509 bytes)

Server will send character column data in multiple chunks of size 255 bytes + remaining chunk at he end(obviously < 255), if column data is >= 254 bytes.

Driver always interprets ‘0xFE’ byte as a prefix byte followed by length-byte of next chunk. But this is not always correct. Here second ‘0xFE’ byte represents actual length of next chunk. 

Driver follows the above interpretation when server charset is other than UTF8.

This logic is based on the idea that server sends column data as chunks and each chunk prefixed by '0xFE' byte. However, in latest Oracle version V12.1.0.2.0, the format changed. Server might have changed the behavior. 

Server versions <=10.2 also not sending column-data with '0xFE' byte in front of each data chunk.

For Oracle versions <=11, every chunk have max size of '0x40' bytes, and for other Versions >=12.1, every chunk have max size of '0xFF' bytes.

Until now, all server versions behave the same way "The first 0xFE byte indicates that the column data is being returned in chunks. If the data to be returned was < 254 bytes, then the 0xFE byte would not be there. Rather, a single byte indicating the entire data length would be present"

////////Suspect code area

//ttcstmt.cpp:9897

// For server connections that have the server perform the charset conversions,

// character datatypes will have an additional 0xFE byte preceding the chunk.

if ((dataSize == 254) &&

typeIsChar &&

(SrvrHandle->ConvertFlag >= 2) &&

((ret = ReadBuffer.readU8 (&dataSize)) != TTC_SUCCESS)) {

goto ttcError;

}

Fixed in hotfix 07.16.0302 and 8.02.2083

Refer to "Connect and Connect64 for ODBC hot fix download and install instructions" for instructions on how to download and install the hot fix.