[freetds] freetds-0.63 bug & fix
KC
kcc1967 at gmail.com
Fri Jul 22 08:26:20 EDT 2005
Hi,
I think I found a bug for freetds-0.63.
In file freetds-0.63/src/tds/query.c line 1134~1144, function
tds_put_data(), the orignal code is:
..........................
#ifdef WORDS_BIGENDIAN
unsigned char buf[64];
if (tds->emul_little_endian && colsize < 64) {
tdsdump_log(TDS_DBG_INFO1, "swapping coltype %d\n",
tds_get_conversion_type(curcol->column_type, colsize));
memcpy(buf, s, colsize);
tds_swap_datatype(tds_get_conversion_type(curcol->column_type,
colsize), buf);
s = buf;
}
#endif
............................
The "s = buf;" should be replaced by "memcpy(s,buf,colsize);",
since "buf" is local which is not allocated by malloc(). Use "s=buf"
will cause following tds_convert_string_free((char*)src, s) try
to free "s" ... and that will cause Segmentation Fault.
Regards,
KC
kccheng at LinuxDAQ-Labs.org
More information about the FreeTDS
mailing list