Buffer Overflow ?
camber at ais.org
Wed Jan 24 18:35:41 EST 2001
Technically it is defined by the API as length of dest, I don't have the
doc in front of me but I believe it is something like 'size of buffer
into which the data will be copied' (remember that tds_convert is called
by dbconvert, ct_convert and implicitly by binding a to a different type).
So there is an off by one error, and I'll apply the patch.
On Wed, 24 Jan 2001, Mark Schaal wrote:
> IMO, destlen should be the length of dest. However, Brian is the
> one who has the final say on this.
> > Now I understand better what the issue here is. Looking at this code more
> > closely, I see a point in tds_convert_binary() as well, where it's assumed
> > that dest[destlen] is writeable. However, in other parts of the same function
> > it copies no more than 'destlen' bytes. What is the meaning of the 'destlen'
> > argument? I find places in the code where it is used to mean 'the size of
> > dest', and places where it's used to mean 'the highest valid index of dest'.
> > (about half of each) Which of these is the 'correct' meaning?
> > If someone can tell me that, I'd be happy to audit the code and put together a
> > patch that fixes the remaining off-by-one errors.
> > Regards,
> > Steve Langasek
> > postmodern programmer
> Mark J. Schaal Phone: (909) 620-7724
> TST On Ramp Fax: (909) 620-8174
> System Administrator E-Mail: mark at tstonramp.com
> You are currently subscribed to freetds as: [camber at ais.org]
> To unsubscribe, forward this message to $subst('Email.Unsub')
More information about the FreeTDS