[freetds] freebcp from 0.64 segfaults on image fields
ZIGLIO, Frediano, VF-IT
Frediano.Ziglio at vodafone.com
Fri Aug 11 09:52:31 EDT 2006
>
> Hi All,
>
> I noticed that attempt to bcp out a table with image column containing
> data >129bytes long causing freebcp's segfault:
>
> bash-2.05b$ uname -smr
> Linux 2.4.23-P4-4G i686
> bash-2.05b$ sqsh -S MSSQL0 -D testdb
> [101] MSSQL0.testdb.1> create table img(id int identity, data image)
> [101] MSSQL0.testdb.2> insert img (data) select replicate ('a',130)
> [101] MSSQL0.testdb.3> go
> bash-2.05b$ freebcp testdb.dbo.img out /tmp/foo.bcp -c -S
> MSSQL0 -U ... -P ...
>
> Starting copy...
>
> Segmentation fault
>
>
> Image fields of smaller size (129 bytes and less) work fine.
>
Confirmed!
bcp use dbconvert with -1 as destlen to not pad strings however making
so it cause a buffer overflow if string is longer that 256. In this case
converting from binary/image to char every byte is doubles ('a' -> '61')
so the buffer overflow occur. Always look twice at functions that take
pointers to buffer without length...
>
> In native mode (-n option), freebcp gives error:
>
> Msg 20053, Level 4
> Requested data conversion does not exist
>
>
> and produced data file doesn't seem to be right:
>
> bash-2.05b$ od -h /tmp/foo.bcp
> 0000000 ffff ffff
> 0000004
>
> Any idea what could be wrong?
>
I'll look even at native mode.
bye
freddy77
More information about the FreeTDS
mailing list