freetds AT lists.ibiblio.org
Subject: FreeTDS Development Group
List archive
- From: Claudio Cicali <c.cicali AT mclink.it>
- To: freetds AT franklin.oit.unc.edu
- Subject: Buffer Overflow ?
- Date: Thu, 18 Jan 2001 11:17:11 +0100
In convert.c
TDS_INT tds_convert_text(int srctype,unsigned char *src,TDS_UINT srclen,
int desttype,unsigned char *dest,TDS_UINT destlen)
{
int cplen;
switch(desttype) {
case SYBTEXT:
cplen = srclen > destlen ? destlen : srclen;
memcpy(dest, src, cplen);
return cplen;
case SYBCHAR:
cplen = srclen;
if (destlen<cplen) cplen = destlen;
if (cplen>255) cplen=255;
memcpy(dest, src, cplen);
dest[cplen]='\0'; <----------- if dest was dest[255] this writes "dest[256]"
return cplen; It should be dest[cplen-1] = '\0'
}
}
+-------------------+----------------------+
| Claudio Cicali | http://www.flexer.it |
|c.cicali AT mclink.it | Nerd Made Good |
+-------------------+----------------------+
-
Buffer Overflow ?,
Claudio Cicali, 01/18/2001
- <Possible follow-up(s)>
- Re: Buffer Overflow ?, Steve Langasek, 01/23/2001
-
Re: Buffer Overflow ?,
Claudio Cicali, 01/23/2001
- Re: Buffer Overflow ?, Steve Langasek, 01/23/2001
- Re: Buffer Overflow ?, James Cameron, 01/23/2001
- Re: Buffer Overflow ?, Mark Schaal, 01/24/2001
- Re: Buffer Overflow ?, Brian Bruns, 01/24/2001
- Re: Buffer Overflow ?, Steve Langasek, 01/25/2001
- Re: Buffer Overflow ?, Brian Bruns, 01/25/2001
Archive powered by MHonArc 2.6.24.