dbdata() broken? alignment error, overflow, Returns length+data, n
Brian Bruns
camber at ais.org
Mon Sep 11 20:29:45 EDT 2000
On Mon, 11 Sep 2000, Dennis Nicklaus wrote:
> I had been using version 0.50. Now that I'm able to get the cvs version,
> I see that fix in mem.c should indeed solve that problem. Thanks.
> sorry to bring up a solved problem.
Cool, that's why my sources didn't jive with what you were saying...0.50
is very, very old. I really need to wrap up a new version, I'm just
waiting for some free time.
> I still think there might a buffer overflow problem here in combination with
> the SYBVARBINARY data with some tds versions.
>
> It appears that things will happen to work at tds version 4.2 because the
> line in token.c tds_process_col_info ( ) :
> info->row_size += curcol->column_size + 1;
> has that extra +1 on it. That coupled with the "remainder =row_size %align"
> check will get the extra word allocated (in my 128 byte rowsize
> example, it will malloc 136 bytes) (4 bytes column_offset + 128 bytes data +
> 4 bytes extra which happen to be needed because of the length put into the
> "varbin" data structure later.)
>
> BUT note that the "remainder =row_size %align" check is inside
> "if (IS_TDS42(tds)) {"
>
> Because of that, it appears to me that at other TDS Versions, (4.6, 5.0?)
> things will overflow the malloced buffer because it'll only malloc
> 133 bytes instead of 136. According to the comments other TDS versions
> aren't supposed to use that tds_process_col_info() function. If that's true,
> I guess everything is OK.
>
Ok, I misunderstood the first time around. It happens...
There should be some special logic to handle TDS_BINARY in
tds_process_results()...something like
if (is_numeric_type(curcol->column_type)) {
info->row_size += sizeof(TDS_NUMERIC) + 1;
+ } else if (is_binary_type(curcol->column_type)) {
+ info->row_size += curcol->column_size +
+ sizeof(TDS_INT); /* varbin->len */
} else if (!is_blob_type(curcol->column_type)) {
info->row_size += curcol->column_size + 1;
}
and dbdata() should probably return varbin->array instead as well...
Brian
More information about the FreeTDS
mailing list