Skip to Content.
Sympa Menu

freetds - [freetds] freetds-0.63 bug & fix

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: KC <kcc1967 AT gmail.com>
  • To: freetds AT lists.ibiblio.org
  • Subject: [freetds] freetds-0.63 bug & fix
  • Date: Fri, 22 Jul 2005 20:26:20 +0800

Hi,

I think I found a bug for freetds-0.63.
In file freetds-0.63/src/tds/query.c line 1134~1144, function
tds_put_data(), the orignal code is:

..........................
#ifdef WORDS_BIGENDIAN
unsigned char buf[64];

if (tds->emul_little_endian && colsize < 64) {
tdsdump_log(TDS_DBG_INFO1, "swapping coltype %d\n",
tds_get_conversion_type(curcol->column_type,
colsize));
memcpy(buf, s, colsize);

tds_swap_datatype(tds_get_conversion_type(curcol->column_type,
colsize), buf);
s = buf;
}
#endif
............................

The "s = buf;" should be replaced by "memcpy(s,buf,colsize);",
since "buf" is local which is not allocated by malloc(). Use "s=buf"
will cause following tds_convert_string_free((char*)src, s) try
to free "s" ... and that will cause Segmentation Fault.


Regards,
KC

kccheng AT LinuxDAQ-Labs.org




Archive powered by MHonArc 2.6.24.

Top of Page