[freetds] bugreport: possible crash when reading empty text field from mssql database using odbc

Michal Seliga michal.seliga at visicom.sk
Mon Dec 7 06:29:43 EST 2009


problem is in function SQLGetData in odbc.c on line 4715 (in my version)

its this context, error line is marked with /*!!!*/

switch (nSybType) {
case SYBCHAR:
case SYBVARCHAR:
case SYBTEXT:
case XSYBCHAR:
case XSYBVARCHAR:
/*!!!*/	nread = (src[0] == '0' && toupper(src[1]) == 'X')? 2 : 0;  /*!!!*/
		
	while ((nread < colinfo->column_cur_size) && (src[nread] == ' ' || src[nread]
== '\0'))
		nread++;

	nread += colinfo->column_text_sqlgetdatapos * 2;
	
	if (nread && nread >= colinfo->column_cur_size)
		ODBC_RETURN(stmt, SQL_NO_DATA);


problem is that on my database i get:
nSybType = 35
colinfo.column_cur_size=0
src= 0x0

but its not recognized as empty or null value, instead it tries to read src[0]
and it causes crash

attached is patch which fixed issue for me, but of course i didn't studied
internals of freetds before doing it and i can't guarantee its correct, please,
someone review it...


-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: odbc.diff
Url: http://lists.ibiblio.org/pipermail/freetds/attachments/20091207/faab1116/attachment.pl 


More information about the FreeTDS mailing list