FreeTDS Development Group

[Brian Bruns <camber AT umcc.ais.org>]

Ugh, I thought I had gotten rid of those! (There were a bunch of buffer
overruns, and I thought I got them all...) Good to know anyway.

Actually (I just peeked at the code) and set_library is doing a strncpy
(which is correct).  I am seeing a problem with the number place there by
tds_put_buf, which is that the source size is used even if it exceeds the
destination size (it should be the lesser of the two).

Here is a replacement for tds_put_buf that should work:

int tds_put_buf(TDSSOCKET *tds, unsigned char *buf, int dsize, int ssize)
{
char *tempbuf;
int  cpsize;

        tempbuf = (char *) malloc(dsize+1);
        memset(tempbuf,'\0',dsize);
        cpsize = ssize > dsize ? dsize : ssize;
        memcpy(tempbuf,buf, cpsize);
        tds_put_n(tds,tempbuf,dsize);
        free(tempbuf);
        tds_put_byte(tds,cpsize);
}


On Fri, 25 Jun 1999 tetherow AT nol.org wrote:

> On 25 Jun, Brian Bruns wrote:
> > Hi Sam,
> > 
> > Sounds good.  May I ask what your prelimary findings are? I'm guessing its
> > some of the magic numbers scattered in the login packet. (It'll be nice
> > once the spec is released)
> 
> I twiddled with a lot, but it seems that there is a problem in the
> put_string if the string is actually longer than length given in
> put_string.  Where I caught the problem was in set_library I was using
> TDS-library which is longer than the 10 bytes that is sent which for
> some reason is messing with the byte afterwards.  I have also noticed
> that there is usually a 0x08 '\b' at the end of strings sent with
> put_string.  I checked the code and couldn't find anything obvious
> that was causing it but I'm getting ready to dig into it tonight.
> 
> ------------------------------------------------------------------------
> Sam Tetherow                           tetherow AT nol.org
> Director of Development
> Nebrask@ Online                        http://www.nol.org/
> 
> 
> ---
> You are currently subscribed to freetds as: camber AT ais.org
> To unsubscribe, forward this message to $subst('Email.Unsub')
> 
>