[freetds] freebcp - problems with blobs >8K

Frediano Ziglio freddy77 at gmail.com
Sun May 18 15:25:35 EDT 2014


2014-05-16 18:42 GMT+01:00 Constantin Vasilyev <vasilyev at ncbi.nlm.nih.gov>:
> Hi FreeTDS team,
>
>
> I ran into a problem trying to freebcp some larger blobs in and out of MS SQL 2008 server.
> The host table may look like:
>
> create table blobs (id int not null, data image)
>
>
>
> Smaller blobs load in and out just fine:
>
>> cat /tmp/blobs.bcp
> 1       0123456780
>> freebcp foo.dbo.blobs in /tmp/blobs.bcp -S MSSQL0 -c -U **** -P ****
>
> Starting copy...
> 1 rows copied.
>>
>
> but once the blob gets larger than 8K the command fails with errors like:
>
>
> Starting copy...
> *** glibc detected *** freebcp: free(): corrupted unsorted chunks: 0x0000000002241a90 ***
> *** glibc detected *** freebcp: malloc(): memory corruption: 0x0000000002243d10 ***
>
> I tried 0.91 stable and 0.92.377 with the same result.
>
> Any clue?
>
>
>
> Constantin
>


Well... good spot. The code actually for bcp and blobs is really
broken. There are two problems:
1- the send row for blobs and tds7+ (mssql) is broken causing buffer
overflow building it. This is quite easy to fix not using row buffer
but sending directly to network;
2- the column data for outputting bcp data is wrong (underestimated)
and dbconvert has no len check causing another buffer overflow. This
is harder to fix as passing len for some types cause extra spaces to
be added.

Frediano


More information about the FreeTDS mailing list