[freetds] suspected corruption

James K. Lowden jklowden at freetds.org
Wed Dec 5 10:31:23 EST 2007


ZIGLIO, Frediano, VF-IT wrote:
> 08:47:27.523087 (dblib.c:513):dbgetnull(0x4103728, 1, -1, 0xbe9a9894)
> 08:47:27.538366 (dblib.c:542):varaddr(0xbe9a9894) varlen -1 < 0?
> t0011: dblib.c:544: dbgetnull: Assertion `varlen > 0' failed.

Thanks for looking at this.  At least you were seeing the same thing I
was, and didn't suspect corruption.  Now I think I know what's going on.  

If varlen == -1 and pnullrep->len == 0, why does the function not return
FAIL?  

Answer: integral promotion.  

The code:

	if (varlen < pnullrep->len) {
		tdsdump_log(...);
		return FAIL;
	} 

needs to be:

	if (varlen < (long)pnullrep->len) {
		tdsdump_log(...);
		return FAIL;
	} 

because varlen is int and pnullrep->len is size_t (unsigned int).  The
rule: for two same-size ints, one signed and the other not, treat the
signed as unsigned.  

Anyone know if gcc can warn about that?  

t0011 now passes, but I'm pretty sure the code is wrong.  dbgetnull()
takes a length and an address; it has no more information than that about
what the NULL should look like.  STRINGBIND means pad the value with
blanks and terminate it with '\0'.  dbgetnull() can't 'pad' because it
doesn't know the column width.  

copy_data_to_host_var must determine the column width and pass it (not -1)
to dbgetnull().  

Regards, 

--jkl



More information about the FreeTDS mailing list