Skip to Content.
Sympa Menu

freetds - Re: Re: dbdata() broken? alignment error, overflow, Returns length+data, n

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Brian Bruns <camber AT ais.org>
  • To: TDS Development Group <freetds AT franklin.oit.unc.edu>
  • Subject: Re: Re: dbdata() broken? alignment error, overflow, Returns length+data, n
  • Date: Mon, 11 Sep 2000 20:29:45 -0400 (EDT)




On Mon, 11 Sep 2000, Dennis Nicklaus wrote:

> I had been using version 0.50. Now that I'm able to get the cvs version,
> I see that fix in mem.c should indeed solve that problem. Thanks.
> sorry to bring up a solved problem.

Cool, that's why my sources didn't jive with what you were saying...0.50
is very, very old. I really need to wrap up a new version, I'm just
waiting for some free time.

> I still think there might a buffer overflow problem here in combination with
> the SYBVARBINARY data with some tds versions.
>
> It appears that things will happen to work at tds version 4.2 because the
> line in token.c tds_process_col_info ( ) :
> info->row_size += curcol->column_size + 1;
> has that extra +1 on it. That coupled with the "remainder =row_size %align"
> check will get the extra word allocated (in my 128 byte rowsize
> example, it will malloc 136 bytes) (4 bytes column_offset + 128 bytes data +
> 4 bytes extra which happen to be needed because of the length put into the
> "varbin" data structure later.)
>
> BUT note that the "remainder =row_size %align" check is inside
> "if (IS_TDS42(tds)) {"
>
> Because of that, it appears to me that at other TDS Versions, (4.6, 5.0?)
> things will overflow the malloced buffer because it'll only malloc
> 133 bytes instead of 136. According to the comments other TDS versions
> aren't supposed to use that tds_process_col_info() function. If that's true,
> I guess everything is OK.
>

Ok, I misunderstood the first time around. It happens...

There should be some special logic to handle TDS_BINARY in
tds_process_results()...something like

if (is_numeric_type(curcol->column_type)) {
info->row_size += sizeof(TDS_NUMERIC) + 1;
+ } else if (is_binary_type(curcol->column_type)) {
+ info->row_size += curcol->column_size +
+ sizeof(TDS_INT); /* varbin->len */
} else if (!is_blob_type(curcol->column_type)) {
info->row_size += curcol->column_size + 1;
}


and dbdata() should probably return varbin->array instead as well...


Brian





Archive powered by MHonArc 2.6.24.

Top of Page