Skip to Content.
Sympa Menu

freetds - [freetds] bugreport: possible crash when reading empty text field from mssql database using odbc

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Michal Seliga <michal.seliga AT visicom.sk>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: [freetds] bugreport: possible crash when reading empty text field from mssql database using odbc
  • Date: Mon, 07 Dec 2009 12:29:43 +0100

problem is in function SQLGetData in odbc.c on line 4715 (in my version)

its this context, error line is marked with /*!!!*/

switch (nSybType) {
case SYBCHAR:
case SYBVARCHAR:
case SYBTEXT:
case XSYBCHAR:
case XSYBVARCHAR:
/*!!!*/ nread = (src[0] == '0' && toupper(src[1]) == 'X')? 2 : 0; /*!!!*/

while ((nread < colinfo->column_cur_size) && (src[nread] == ' ' ||
src[nread]
== '\0'))
nread++;

nread += colinfo->column_text_sqlgetdatapos * 2;

if (nread && nread >= colinfo->column_cur_size)
ODBC_RETURN(stmt, SQL_NO_DATA);


problem is that on my database i get:
nSybType = 35
colinfo.column_cur_size=0
src= 0x0

but its not recognized as empty or null value, instead it tries to read src[0]
and it causes crash

attached is patch which fixed issue for me, but of course i didn't studied
internals of freetds before doing it and i can't guarantee its correct,
please,
someone review it...


--- odbc.c.orig 2009-12-04 14:47:39.000000000 +0100
+++ odbc.c 2009-12-07 12:26:23.709681867 +0100
@@ -4623,7 +4623,7 @@
}
colinfo = resinfo->columns[icol - 1];

- if (colinfo->column_cur_size < 0) {
+ if (colinfo->column_cur_size <= 0) {
*pcbValue = SQL_NULL_DATA;
} else {
nSybType = tds_get_conversion_type(colinfo->column_type,
colinfo->column_size);



Archive powered by MHonArc 2.6.24.

Top of Page