Skip to Content.
Sympa Menu

freetds - Re: [freetds] dbopen buffer overflow

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Frank M. Kromann" <frank AT kromann.info>
  • To: "Lowden, James K" <james.k.lowden AT alliancebernstein.com>
  • Cc: freetds AT lists.ibiblio.org
  • Subject: Re: [freetds] dbopen buffer overflow
  • Date: Wed, 07 Mar 2007 13:14:47 -0800

Thanks James,

That was my understanding too.

I'll make the changes to the PHP extension so they are included only when
linked with Microsofts ntwdblib.lib.

- Frank

> > From: Frank M. Kromann
> > Sent: Wednesday, March 07, 2007 12:33 PM
> >
> > There seams to be a buffer overflow problem in Microsoft version
> > of dbopen() (ntwdblib.dll). I'm trying to create a fix for this in
> > the PHP extension and would like to know if there are any limit to
> > the length of the servername (second parameter) in the FreeTDS
> > version of this function?
>
> Hi Frank,
>
> No. The servername is placed in TDSLOGIN::server_name, which is a DSTR
> type, a structure consisting of a pointer and a length. The length is
> the strlen() of the argument; that much memory is allocated and the
name
> copied to it. There's no opportunity for a buffer overflow.
>
> When the servername is sent to the server in the login packet, it's
> preceded by its length. In the DSTR the length is an int; in the login
> packet it's 16 bits. Nothing prevents the caller from proposing a
> servername with a length of 30 bits. When the login packet is sent, it
> will be malformed, having a servername length of only 16 bits
> (effectively "& 0xFFFF") and the *whole* servername. The only response
> I've ever heard of by the server to a malformed login packet is a
> rejected connection.
>
> HTH. Thanks for your work.
>
> --jkl
>
> -----------------------------------------
> The information contained in this transmission may be privileged and
> confidential and is intended only for the use of the person(s) named
> above. If you are not the intended recipient, or an employee or agent
responsible
> for delivering this message to the intended recipient, any review,
dissemination,
> distribution or duplication of this communication is strictly
prohibited. If you are
> not the intended recipient, please contact the sender immediately by
reply e-mail
> and destroy all copies of the original message. Please note that we do
not accept
> account orders and/or instructions by e-mail, and therefore will not be
responsible
> for carrying out such orders and/or instructions. If you, as the
intended recipient
> of this message, the purpose of which is to inform and update our
clients, prospects
> and consultants of developments relating to our services and products,
would not
> like to receive further e-mail correspondence from the sender, please
"reply" to the
> sender indicating your wishes. In the U.S.: 1345 Avenue of the
Americas, New York,
> NY 10105.
>
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>







Archive powered by MHonArc 2.6.24.

Top of Page