FreeTDS Development Group

["Gene Sokolov" <hook AT akmos.ru>]

There is a serious bug in read.c which can make FreeTDS lock up or eat file
descriptors.

char *tds_get_n(TDSSOCKET *tds, void *dest, int need)
{
....
    while (need>have) {
        /* We need more than is in the buffer, copy what is there */
        if (dest!=NULL) {
             memcpy((char*)dest+pos, tds->in_buf+tds->in_pos, have);
        }
        pos+=have;
        need-=have;
        tds_read_packet(tds);

        have=tds->in_len;
   }
....
}

If the socket is unexpectedly closed while tds_read_packet(tds)
 is reading, the tds->in_len contains 0. The while() obviously never ends.
TDS locks up.

The module token.c calls tds_get_n but also never checks the socket state.
If tds_get_n is fixed to check for the closed socket, the locking up just
moves up one layer. If token.c is fixed, the socket condition is not checked
higher. This is a serious design flaw and a huge source of unexpected
failures.

Gene Sokolov.