[freetds] suhosin[6894]: ALERT - canary mismatch on efree(). Is freeTDS 64 Bit the problem?

Peter Wagner wagnerp at hotmail.de
Mon Apr 27 16:11:48 EDT 2009


Hi all.

SQL select commands under PHP to MS SQL-Server via unixODBC and freeTDS 
returns invalid data under openSUSE x86_64 (openSUSE 10.2 and 11.1).
In /var/log/messages I have
... suhosin[6894]: ALERT - canary mismatch on efree() - heap overflow detected (attacker 'IP', file '...', line ...)
... suhosin[6895]: ALERT - canary mismatch on efree() - heap overflow detected (attacker 'IP', file '...', line ...)
And in /var/log/apache2/error_log I have
... [error] [client IP] ALERT - canary mismatch on efree() - heap overflow detected (attacker 'IP', file '...', line ...)
... [error] [client IP] ALERT - canary mismatch on efree() - heap overflow detected (attacker 'IP', file '...', line ...)

The SAME SQL selects are CORRECT under openSUSE x86_32 (openSUSE 10.2 and 11.1).

Is freeTDS 64 Bit the problem?

The job:
PHP under openSUSE 10.2 x86_64 has to connect to MS SQL-Server 2000.

OS: openSUSE 10.2 x86_64, standard installation, no GUI, only text.
Apache: v2.2.3, SUSE RPM.
PHP: v5.2.0-10, SUSE RPM.

php -v returns
PHP 5.2.0 with Suhosin-Patch 0.9.6.1 (cli) (built: Nov 27 2006 22:39:24)
Copyright (c) 1997-2006 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2006 Zend Technologies

unixODBC: v2.2.14, compiled.
          ./configure --enable-gui=no
          make
          make install

Connection to MS SQL-Server on console:
isql -v MSSQLServer user password
+---------------------------------------+
| Connected!                                       |
|                                                       |
| sql-statement                                    |
| help [tablename]                                |
| quit                                                 |
|                                                       |
+---------------------------------------+

The SQL-select-commands HERE ARE OK.

Also: The logs of unixODBC and freeTDS show that all data arriving correct.

Up to here all seems to be ok.

Now PHP.
Compiling odbc.so from php-src SUSE RPM (v5.2.0-10, the same version as the installed PHP).
phpize
./configure --with-unixODBC=shared,/usr/local
make
make install

In the file /etc/phph5/apache2/php.ini I insert:
extension = odbc.so
Then: /etc/init.d/apache2 restart.

I have two PHP-scripts, see below:
script1: select on a MS SQL table with 1 record: script1 returns nothing.
script2: select on a MS SQL table with 10389 records: script2 returns 10283 records.
So here the result is NOT correct.
The suhosin errors from above are then in /var/log/messages and in /var/log/apache2/error_log.

An analog installation on openSUSE 10.2 x86_32:
script1: select on a MS SQL table with 1 record: script1 returns 1 record.
script2: select on a MS SQL table with 10389 records: script2 returns 10389 records.
So here the result is correct.
No suhosin error occur.

So:
32 Bit seems to be ok.
64 Bit seems to be ok up to unixODBC und freeTDS.
But PHP is not ok.

An analog installation on openSUSE 11.1 has the same result:
32 Bit seems to be ok.
64 Bit seems to be ok up to unixODBC und freeTDS.
But PHP (here v5.2.6-49.13) is not ok.

An analog installation on openSUSE 10.2 with the trial easysoft driver.
64 Bit is OK, PHP is returns the correct results.

Is this a driver-problem?
Because with 64-Bit easysoft driver I get correct results.
With 64-Bit freeTDS driver I get no correct results.

Has someone an idea?
Thank you.

----------------------------

Here are the PHP-scripts.
Only the tables in the select-command are different.

<?php

    error_reporting(E_ALL);

    $dsn="Driver=FreeTDS;TDS_Version=8.0;Server=IP_to_SQL_Server;Port=1433;Database=database_to_connect;UID=user;PWD=password";

    $connect = odbc_connect($dsn, "user", "password");

    print "Connect: $connect";

    $query = "SELECT * FROM table";

    $result = odbc_exec($connect, $query);

    while(odbc_fetch_row($result)) {
    $field1 = odbc_result($result, 1);
    $field2 = odbc_result($result, 2);
    $field3 = odbc_result($result, 3);
    $field4 = odbc_result($result, 4);
    print("$field1 $field2 $field3 $field4\n");
    print "<hr>";
    }

    odbc_close($connect);

?>


_________________________________________________________________
http://redirect.gimas.net/?n=M0904xWLCalendar2
Keinen Termin mehr verpassen! Mit Windows Live Kalender.


More information about the FreeTDS mailing list