[freetds] Segfault in tds_convert_key

Chris Spears Chris.Spears at harrynorman.com
Wed Apr 30 09:34:30 EDT 2003


Log file:


Starting log file for FreeTDS 0.62.dev.20030430 with debug level 99.
iconv will convert client-side data to the "ISO-8859-1" character set
2003-04-30 09:25:50.780148 Connecting to 192.168.31.46 port 1433, TDS 7.0.
2003-04-30 09:25:50.780746 tds_put_string converting 14 bytes of
"RADIUS-031-001"
2003-04-30 09:25:50.780829 tds_put_string wrote 28 bytes
2003-04-30 09:25:50.780852 tds_put_string converting 10 bytes of
"FREERADIUS"
2003-04-30 09:25:50.780877 tds_put_string wrote 20 bytes
2003-04-30 09:25:50.780898 tds_put_string converting 4 bytes of "Test"
2003-04-30 09:25:50.780922 tds_put_string wrote 8 bytes
2003-04-30 09:25:50.780943 tds_put_string converting 11 bytes of
"TDS-Library"
2003-04-30 09:25:50.780968 tds_put_string wrote 22 bytes
2003-04-30 09:25:50.780988 tds_put_string converting 10 bytes of
"us_english"
2003-04-30 09:25:50.781013 tds_put_string wrote 20 bytes
2003-04-30 09:25:50.781033 tds_put_string wrote 0 bytes
2003-04-30 09:25:50.781194 inside tds_process_login_tokens()
Received header @ 2003-04-30 09:25:50.783161
0000  04 00 00 3b 00 00 01 00                            |...;....|


Received packet @ 2003-04-30 09:25:50.783237
0000  ed 30 00 4e 54 4c 4d 53  53 50 00 02 00 00 00 00   |.0.NTLMS SP......|
0010  00 00 00 30 00 00 00 01  82 00 00 e4 1e 6b 84 74   |...0.... .....k.t|
0020  ce f4 ba 00 00 00 00 00  00 00 00 00 00 00 00 30   |........ .......0|
0030  00 00 00                                           |...|


2003-04-30 09:25:50.783303 looking for login token, got  ed(AUTH)
TDS_AUTH_TOKEN PDU size 48
TDS_AUTH_TOKEN nonce
0000  e4 1e 6b 84 74 ce f4 ba                            |..k.t...|

2003-04-30 09:25:50.783388 Draining 8 bytes
2003-04-30 09:25:50.783421 tds_put_string converting 11 bytes of
"DOMAINNAME"
2003-04-30 09:25:50.783453 tds_put_string wrote 22 bytes
2003-04-30 09:25:50.783474 tds_put_string converting 12 bytes of
"Chris.Spears"
2003-04-30 09:25:50.783498 tds_put_string wrote 24 bytes
2003-04-30 09:25:50.783519 tds_put_string converting 14 bytes of
"RADIUS-031-001"
2003-04-30 09:25:50.783543 tds_put_string wrote 28 bytes
Died in tds_convert_key


---------------------------------------------

I added some output statements to challenge.c here are the relevant blocks
of code.


----------------- Challenge.c --------------------------------

void
tds_answer_challenge(const char *passwd, const unsigned char *challenge,
TDSANSWER * answer)
{
.
.
.

        /* hash the first 7 characters */
        tds_convert_key(passwd_up, &ks);
tdsdump_log(TDS_DBG_ERROR, "Never made it out of convert_key");
        tds_des_ecb_encrypt(&magic, sizeof(magic), &ks, (hash + 0));
.
.
.
.
}

static void
tds_convert_key(unsigned char *key_56, DES_KEY * ks)
{
        des_cblock key;
.
.
.
        des_set_odd_parity(key);
        des_set_key(ks, key, sizeof(key));

        memset(&key, 0, sizeof(key));
tdsdump_log(TDS_DBG_ERROR, "Died in tds_convert_key");
}

---------------------- End Challenge.c
-------------------------------------------------


I am building this code as a module.


-----------------My Code---------------------------------

typedef struct rlm_sql_freetds_sock {
        TDSSOCKET *tds;
        TDSLOGIN *login;
        TDSCONTEXT *context;
        TDSCONNECTINFO *connect_info;

        char **row;
        void *conn;
} rlm_sql_freetds_sock;;

static int sql_init_socket(SQLSOCK *sqlsocket, SQL_CONFIG *config) {
    rlm_sql_freetds_sock *freetds_sock;

    char *charset = "UTF-8";
    char *locale = NULL;


    /* Allocating memory for the new socket */
    sqlsocket->conn = (rlm_sql_freetds_sock
*)rad_malloc(sizeof(rlm_sql_freetds_sock));
    freetds_sock = sqlsocket->conn;

    /* Setting connection parameters */
    freetds_sock->login = tds_alloc_login();
    freetds_sock->context = tds_alloc_context();
    if(freetds_sock->context->locale &&
!freetds_sock->context->locale->date_fmt) {
        freetds_sock->context->locale->date_fmt = strdup("%b %e %Y
%I:%M%p");
    }

    setlocale(LC_ALL, "");
    locale = setlocale(LC_ALL, NULL);

    tds_set_user    (freetds_sock->login, "Chris.Spears");
    tds_set_app     (freetds_sock->login, "FREERADIUS");
    tds_set_library (freetds_sock->login, "TDS-Library");
    tds_set_server  (freetds_sock->login, "Test");
    tds_set_port    (freetds_sock->login, 1433);
    tds_set_client_charset (freetds_sock->login, charset);
    tds_set_language(freetds_sock->login, "us_english");
    tds_set_packet  (freetds_sock->login, 512);
    tds_set_passwd  (freetds_sock->login, "hello12");

    freetds_sock->tds = tds_alloc_socket(freetds_sock->context, 512);
    tds_set_parent(freetds_sock->tds, NULL);

    freetds_sock->connect_info = tds_read_config_info(NULL,
freetds_sock->login, freetds_sock->context->locale);
    /* Do connection */

    if (!freetds_sock->connect_info || tds_connect(freetds_sock->tds,
freetds_sock->connect_info) == TDS_FAIL)
    {
        radlog(L_ERR, "rlm_sql_freetds: Can't connect to the database
server");
        return -1;
    }

    /* All fine - exiting */
    return 0;
}

-------------End--------------------

Seems very odd to me that it dies in that spot.  TSQL connects
to the mssql2k database no problem with the exact same code.  
I attempted to use gdb to discover exactly where it dies but it 
appears the memory is corrupted upon dead and gdb could not 
read any of the frames.  

Does this have anything to do with the charset problem?  If I comment
out the call to tds_answer_challenge(*) and rebuild the libraries it 
removes the segfault problem.


Thanks,
Chris Spears



More information about the FreeTDS mailing list