Skip to Content.
Sympa Menu

freetds - Re: [freetds] bugreport: possible crash when reading empty text field from mssql database using odbc

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Frediano Ziglio <freddy77 AT gmail.com>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] bugreport: possible crash when reading empty text field from mssql database using odbc
  • Date: Tue, 08 Dec 2009 12:02:12 +0100

Il giorno lun, 07/12/2009 alle 12.29 +0100, Michal Seliga ha scritto:
> problem is in function SQLGetData in odbc.c on line 4715 (in my version)
>
> its this context, error line is marked with /*!!!*/
>
> switch (nSybType) {
> case SYBCHAR:
> case SYBVARCHAR:
> case SYBTEXT:
> case XSYBCHAR:
> case XSYBVARCHAR:
> /*!!!*/ nread = (src[0] == '0' && toupper(src[1]) == 'X')? 2 : 0;
> /*!!!*/
>
> while ((nread < colinfo->column_cur_size) && (src[nread] == ' ' ||
> src[nread]
> == '\0'))
> nread++;
>
> nread += colinfo->column_text_sqlgetdatapos * 2;
>
> if (nread && nread >= colinfo->column_cur_size)
> ODBC_RETURN(stmt, SQL_NO_DATA);
>
>
> problem is that on my database i get:
> nSybType = 35
> colinfo.column_cur_size=0
> src= 0x0
>
> but its not recognized as empty or null value, instead it tries to read
> src[0]
> and it causes crash
>
> attached is patch which fixed issue for me, but of course i didn't studied
> internals of freetds before doing it and i can't guarantee its correct,
> please,
> someone review it...
>
>
> Documento in testo semplice allegato (odbc.diff)
> --- odbc.c.orig 2009-12-04 14:47:39.000000000 +0100
> +++ odbc.c 2009-12-07 12:26:23.709681867 +0100
> @@ -4623,7 +4623,7 @@
> }
> colinfo = resinfo->columns[icol - 1];
>
> - if (colinfo->column_cur_size < 0) {
> + if (colinfo->column_cur_size <= 0) {
> *pcbValue = SQL_NULL_DATA;
> } else {
> nSybType = tds_get_conversion_type(colinfo->column_type,
> colinfo->column_size);

Fixed in CVS, test added too. CVS HEAD didn't have this problem. Your
patch handle in this specific case threat empty like NULLs, I added a
test to avoid invalid memory access instead.

Thanks for pointing out,
Frediano






Archive powered by MHonArc 2.6.24.

Top of Page