FreeTDS Development Group

[Brian Bruns <camber AT ais.org>]

On Mon, 11 Sep 2000, Dennis Nicklaus wrote:

> I had been using version 0.50. Now that I'm able to get the cvs version,
> I see that fix in mem.c should indeed solve that problem. Thanks.
> sorry to bring up a solved problem.

Cool, that's why my sources didn't jive with what you were saying...0.50
is very, very old.  I really need to wrap up a new version, I'm just
waiting for some free time.

> I still think there might a buffer overflow problem here in combination with
> the SYBVARBINARY data with some tds versions.
> 
> It appears that things will happen to work at tds version 4.2 because the
> line in token.c  tds_process_col_info ( ) :
>               info->row_size += curcol->column_size + 1;
> has that extra +1 on it. That coupled with the "remainder =row_size %align"
> check will get the extra word allocated (in my 128 byte rowsize
> example, it will malloc 136 bytes) (4 bytes column_offset + 128 bytes data +
> 4 bytes extra which happen to be needed because of the length put into the
> "varbin" data structure later.)
> 
> BUT note that the "remainder =row_size %align" check is inside
>  "if (IS_TDS42(tds)) {"
> 
> Because of that, it appears to me that at other TDS Versions, (4.6, 5.0?)
> things will overflow the malloced buffer because it'll only malloc
> 133 bytes instead of 136. According to the comments other TDS versions
> aren't supposed to use that tds_process_col_info() function. If that's true,
> I guess everything is OK.  
> 

Ok, I misunderstood the first time around. It happens... 

There should be some special logic to handle TDS_BINARY in
tds_process_results()...something like 

                if (is_numeric_type(curcol->column_type)) {
                        info->row_size += sizeof(TDS_NUMERIC) + 1;
+               } else if (is_binary_type(curcol->column_type)) {
+                       info->row_size += curcol->column_size +
+                               sizeof(TDS_INT); /* varbin->len */
                } else if (!is_blob_type(curcol->column_type)) {
                        info->row_size += curcol->column_size + 1; 
                }


and dbdata() should probably return varbin->array instead as well...


Brian