Skip to Content.
Sympa Menu

freetds - Re: [freetds] Freebcp coredump

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Frediano Ziglio" <freddy77 AT gmail.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] Freebcp coredump
  • Date: Tue, 9 Dec 2008 16:12:42 +0100

2008/12/9 <dmarrer AT bci.cl>:
> Hello James:
>
> Here is aditional information that i get with gdb
>
> (gdb) backtrace
> #0 0x60000000c01d8e20:1 in strlen+0x41 () from /usr/lib/hpux32/libc.so.1
> #1 0x60000000c025efe0:0 in strdup+0x30 () from /usr/lib/hpux32/libc.so.1
> #2 0x60000000cabdd970:0 in bcp_init () at bcp.c:181
> #3 0x4002a40:0 in file_formatted (pdata=0x7fffeea4, dir=2) at
> freebcp.c:580
> #4 0x40050c0:0 in main (argc=9, argv=0x7ffff368) at freebcp.c:96
>
> (gdb) frame 4
> #4 0x40050c0:0 in main (argc=9, argv=0x7ffff368) at freebcp.c:96
> 96 ok = file_formatted(&params, dbproc,
> params.direction);
>
> (gdb) info locals
> params = {dbobject = 0x400180e0 "VW_GETDATA",
> dbdirection = "out\000\000\000\000\000\000", direction = 2,
> hostfilename = "res_eact.txt\000\000", formatfile = "/home/mysystem/fmt
> ",
> errorfile = 0x6d705f76 <Address 0x6d705f76 out of bounds>,
> interfacesfile = "ig.fmt\000\000\000\000\000\000\000\000", firstrow = 0,
> lastrow = 0, batchsize = 1000, maxerrors = 10, textsize = 4096,
> fieldterm = 0x0, fieldtermlen = 0, rowterm = 0x0, rowtermlen = 0,
> user = 0x400192f0 "user", pass = 0x40019310 "password",
> server = 0x40018110 "MYSERVER", hint = 0x0, options = 0x0,
> packetsize = 0, mflag = 0, fflag = 1, eflag = 1, Fflag = 0, Lflag = 0,
> bflag = 0, nflag = 0, cflag = 0, tflag = 0, rflag = 0, Uflag = 1, Iflag
> = 0,
> Sflag = 1, Pflag = 1, Tflag = 0, Aflag = 0, Eflag = 0}
>
> (gdb) frame 3
> #3 0x4002a40:0 in file_formatted (pdata=0x7fffeea4, dir=2) at
> freebcp.c:580
> 580 if (FAIL == bcp_init(dbproc, pdata->dbobject,
> pdata->hostfilename, pdata->errorfile, dir))
>
> (gdb) info locals
> li_rowsread = 1610612736
>
> (gdb) info args
> pdata = (struct pd *) 0x7fffeea4
> dir = 2
>
> (gdb) frame 2
> #2 0x60000000cabdd970:0 in bcp_init () at bcp.c:181
> 181 if ((dbproc->hostfileinfo->errorfile =
> strdup(errfile)) == NULL)
>
> Thanks a lot
>
> Daymel
>
>

Bingo !!!
This is a buffer overflow due to FILENAME_MAX definition in HP-UX.
This define is quite short leading in a buffer overflow in freebcp
(the bug reside in freebcp.c). You got the corruption setting
formatfile. A strcpyn should be used to avoid overflow. The best
solution (IMHO) is to use char * in freebcp.c for hostfilename,
formatfile and interfacesfile requiring strdup instead of strcpy.

Please try attached patch and let me know.

freddy77

Attachment: bcp.diff
Description: Binary data




Archive powered by MHonArc 2.6.24.

Top of Page