Buffer Overflow ?

Brian Bruns camber at ais.org
Wed Jan 24 18:35:41 EST 2001



Technically it is defined by the API as length of dest, I don't have the
doc in front of me but I believe it is something like 'size of buffer
into which the data will be copied' (remember that tds_convert is called
by dbconvert, ct_convert and implicitly by binding a to a different type).

So there is an off by one error, and I'll apply the patch.

Brian

On Wed, 24 Jan 2001, Mark Schaal wrote:

> 
> IMO, destlen should be the length of dest.  However, Brian is the
> one who has the final say on this.
> 
> Mark
> 
> > 
> > Now I understand better what the issue here is.  Looking at this code more
> > closely, I see a point in tds_convert_binary() as well, where it's assumed
> > that dest[destlen] is writeable.  However, in other parts of the same function
> > it copies no more than 'destlen' bytes.  What is the meaning of the 'destlen'
> > argument?  I find places in the code where it is used to mean 'the size of
> > dest', and places where it's used to mean 'the highest valid index of dest[]'.
> > (about half of each)  Which of these is the 'correct' meaning?
> > 
> > If someone can tell me that, I'd be happy to audit the code and put together a
> > patch that fixes the remaining off-by-one errors.
> > 
> > Regards,
> > Steve Langasek
> > postmodern programmer
> 
> -- 
> Mark J. Schaal					Phone:      (909) 620-7724
> TST On Ramp					Fax:	    (909) 620-8174
> System Administrator				E-Mail: mark at tstonramp.com
> 
> ---
> You are currently subscribed to freetds as: [camber at ais.org]
> To unsubscribe, forward this message to $subst('Email.Unsub')
> 





More information about the FreeTDS mailing list