FreeTDS Development Group

[Steve Langasek <vorlon AT netexpress.net>]

Hi Claudio,

I'm not sure I understand what you're saying.  How can this buffer overflow
happen?  From what I see, cplen is never more than 255, and it's also never
more than the value of destlen.  If cplen == 255, then the code will write
dest[255] = '\0', which should be ok if our buffer is 256 chars in size.  Can
you tell us where this is a problem?  Is there a place in the code where
tds_convert_text() is being called with the wrong value for 'destlen'?

Regards,
Steve Langasek
postmodern programmer

> In convert.c

> TDS_INT tds_convert_text(int srctype,unsigned char *src,TDS_UINT srclen,
>          int desttype,unsigned char *dest,TDS_UINT destlen)
> {
> int cplen;
> 
>     switch(desttype) {
>        case SYBTEXT:
>           cplen = srclen > destlen ? destlen : srclen;
>           memcpy(dest, src, cplen);
>           return cplen;
>        case SYBCHAR:
>           cplen = srclen;
>           if (destlen<cplen) cplen = destlen;
>           if (cplen>255) cplen=255;
>           memcpy(dest, src, cplen);
>           dest[cplen]='\0';        <----------- if dest was dest[255] this 
> writes "dest[256]"
>           return cplen;                         It should be dest[cplen-1] 
> = '\0'
>     }
> }