[freetds] freebcp from 0.64 segfaults on image fields

ZIGLIO, Frediano, VF-IT Frediano.Ziglio at vodafone.com
Fri Aug 11 09:52:31 EDT 2006


> 
> Hi All,
> 
> I noticed that attempt to bcp out a table with image column containing
> data >129bytes long causing freebcp's segfault:
> 
> bash-2.05b$ uname -smr
> Linux 2.4.23-P4-4G i686
> bash-2.05b$ sqsh -S MSSQL0 -D testdb
> [101] MSSQL0.testdb.1> create table img(id int identity, data image)
> [101] MSSQL0.testdb.2> insert img (data) select replicate ('a',130)
> [101] MSSQL0.testdb.3> go
> bash-2.05b$ freebcp testdb.dbo.img out /tmp/foo.bcp -c -S 
> MSSQL0 -U ... -P ...
> 
> Starting copy...
> 
> Segmentation fault
> 
> 
> Image fields of smaller size (129 bytes and less) work fine.
> 

Confirmed!
bcp use dbconvert with -1 as destlen to not pad strings however making
so it cause a buffer overflow if string is longer that 256. In this case
converting from binary/image to char every byte is doubles ('a' -> '61')
so the buffer overflow occur. Always look twice at functions that take
pointers to buffer without length...

> 
> In native mode (-n option), freebcp gives error:
> 
> Msg 20053, Level 4
> Requested data conversion does not exist
> 
> 
> and produced data file doesn't seem to be right:
> 
> bash-2.05b$ od -h /tmp/foo.bcp
> 0000000 ffff ffff
> 0000004
> 
> Any idea what could be wrong?
> 

I'll look even at native mode.

bye
  freddy77




More information about the FreeTDS mailing list