Skip to Content.
Sympa Menu

freetds - Re: Buffer Overflow ?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: James Cameron <cameron AT stl.dec.com>
  • To: TDS Development Group <freetds AT franklin.oit.unc.edu>
  • Subject: Re: Buffer Overflow ?
  • Date: Wed, 24 Jan 2001 13:56:49 +1100


I think Claudio's patch is correct.

Imagine this prelude ...

#define SRCLEN 512
#define DESTLEN 255
char src[SRCLEN]
char dest[DESTLEN];
int srclen = 300;
int destlen = DESTLEN;
int cplen;

Now, taking the code in the source ...

> cplen = srclen;

Fine. The copy length. Set to 300.

> if (destlen<cplen) cplen = destlen;

destlen was less than cplen, so cplen is now 255.

> if (cplen>255) cplen=255;

cplen remains at 255.

> memcpy(dest, src, cplen);

255 characters are copied.

> dest[cplen]='\0';

dest[255] is set to 0. That's not good. dest[0] to dest[254] are okay
to use, but not dest[255]. Yes, an overrun.

I had to think outside the box ...

char x[2];
x[0] is first char
x[1] is second char
x[2] is an overrun

--
James Cameron (james.cameron AT compaq.com)

http://quozl.linux.org.au/ (or) http://quozl.netrek.org/




Archive powered by MHonArc 2.6.24.

Top of Page