Skip to Content.
Sympa Menu

freetds - Buffer Overflow ?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Claudio Cicali <c.cicali AT mclink.it>
  • To: freetds AT franklin.oit.unc.edu
  • Subject: Buffer Overflow ?
  • Date: Thu, 18 Jan 2001 11:17:11 +0100


In convert.c

TDS_INT tds_convert_text(int srctype,unsigned char *src,TDS_UINT srclen,
int desttype,unsigned char *dest,TDS_UINT destlen)
{
int cplen;

switch(desttype) {
case SYBTEXT:
cplen = srclen > destlen ? destlen : srclen;
memcpy(dest, src, cplen);
return cplen;
case SYBCHAR:
cplen = srclen;
if (destlen<cplen) cplen = destlen;
if (cplen>255) cplen=255;
memcpy(dest, src, cplen);
dest[cplen]='\0'; <----------- if dest was dest[255] this writes "dest[256]"
return cplen; It should be dest[cplen-1] = '\0'
}
}

+-------------------+----------------------+
| Claudio Cicali | http://www.flexer.it |
|c.cicali AT mclink.it | Nerd Made Good |
+-------------------+----------------------+





Archive powered by MHonArc 2.6.24.

Top of Page