0.60 + PHP + MSSQL2K segfault -- depends on the query (??)

Frediano Ziglio freddyz77 at tin.it
Fri May 2 19:13:14 EDT 2003


Il sab, 2002-11-16 alle 00:43, Lowden, James K ha scritto:
> > From: Frediano Ziglio [mailto:freddyz77 at tin.it]
> > Sent: November 15, 2002 6:37 PM
> > 
> > Il ven, 2002-11-15 alle 21:14, Paul Kiela ha scritto:
> > > Hey guys,
> > > 
> > > Having a segfault problem getting data out of my MS-SQL 
> > server using FreeTDS and PHP.
> 
> > Only a question. Are there a numeric field in Orders table ?
> 
> No, see my lengthy reply. :)
> 

Opss...
See this code (PHP 4.2.3, ext/sybase)

if (dbwillconvert(coltype(offset),SYBCHAR)) {
  char *res_buf;
  int res_length = dbdatlen(sybase_ptr->link,offset);
  register char *p;

  switch (coltype(offset)) {
  case SYBBINARY:
  case SYBVARBINARY:
  case SYBCHAR:
  case SYBVARCHAR:
  case SYBTEXT:
  case SYBIMAGE:
    break;
  default:
    /* take no chances, no telling how big the result would really be */
    res_length += 20;
    break;
  }

  res_buf = (char *) emalloc(res_length+1);
  memset(res_buf,' ',res_length+1);  /* XXX i'm sure there's a better
way
                                                                                                          but i don't have sybase here to test
                                                                                                          991105 thies at thieso.net  */

  dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset),
res_length,SYBCHAR,res_buf,-1);

Converting binary -> char PHP allocate only length+1 bytes of binary but
conversion binary -> char require 2*length bytes (plus terminator), do
it's a buffer overflow.
So, or PHP is wrong and should allocate more space or FreeTDS dblib is
wrong and conversion binary -> char should just do a memcpy instead of
converting to hexadecimal...

freddy77





More information about the FreeTDS mailing list