Skip to Content.
Sympa Menu

freetds - Re: Buffer Overflow ?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Steve Langasek <vorlon AT netexpress.net>
  • To: Claudio Cicali <c.cicali AT mclink.it>
  • Cc: TDS Development Group <freetds AT franklin.oit.unc.edu>
  • Subject: Re: Buffer Overflow ?
  • Date: Tue, 23 Jan 2001 17:46:17 -0600 (CST)


Hi Claudio,

I'm not sure I understand what you're saying. How can this buffer overflow
happen? From what I see, cplen is never more than 255, and it's also never
more than the value of destlen. If cplen == 255, then the code will write
dest[255] = '\0', which should be ok if our buffer is 256 chars in size. Can
you tell us where this is a problem? Is there a place in the code where
tds_convert_text() is being called with the wrong value for 'destlen'?

Regards,
Steve Langasek
postmodern programmer

> In convert.c

> TDS_INT tds_convert_text(int srctype,unsigned char *src,TDS_UINT srclen,
> int desttype,unsigned char *dest,TDS_UINT destlen)
> {
> int cplen;
>
> switch(desttype) {
> case SYBTEXT:
> cplen = srclen > destlen ? destlen : srclen;
> memcpy(dest, src, cplen);
> return cplen;
> case SYBCHAR:
> cplen = srclen;
> if (destlen<cplen) cplen = destlen;
> if (cplen>255) cplen=255;
> memcpy(dest, src, cplen);
> dest[cplen]='\0'; <----------- if dest was dest[255] this
> writes "dest[256]"
> return cplen; It should be dest[cplen-1]
> = '\0'
> }
> }







Archive powered by MHonArc 2.6.24.

Top of Page