Buffer Overflow ?
Steve Langasek
vorlon at netexpress.net
Tue Jan 23 18:46:17 EST 2001
Hi Claudio,
I'm not sure I understand what you're saying. How can this buffer overflow
happen? From what I see, cplen is never more than 255, and it's also never
more than the value of destlen. If cplen == 255, then the code will write
dest[255] = '\0', which should be ok if our buffer is 256 chars in size. Can
you tell us where this is a problem? Is there a place in the code where
tds_convert_text() is being called with the wrong value for 'destlen'?
Regards,
Steve Langasek
postmodern programmer
> In convert.c
> TDS_INT tds_convert_text(int srctype,unsigned char *src,TDS_UINT srclen,
> int desttype,unsigned char *dest,TDS_UINT destlen)
> {
> int cplen;
>
> switch(desttype) {
> case SYBTEXT:
> cplen = srclen > destlen ? destlen : srclen;
> memcpy(dest, src, cplen);
> return cplen;
> case SYBCHAR:
> cplen = srclen;
> if (destlen<cplen) cplen = destlen;
> if (cplen>255) cplen=255;
> memcpy(dest, src, cplen);
> dest[cplen]='\0'; <----------- if dest was dest[255] this
> writes "dest[256]"
> return cplen; It should be dest[cplen-1]
> = '\0'
> }
> }
More information about the FreeTDS
mailing list