FreeTDS Development Group

[James Cameron <cameron AT stl.dec.com>]

I think Claudio's patch is correct.

Imagine this prelude ...

#define SRCLEN 512
#define DESTLEN 255
char src[SRCLEN]
char dest[DESTLEN];
int srclen = 300;
int destlen = DESTLEN;
int cplen;

Now, taking the code in the source ...

>           cplen = srclen;

Fine.  The copy length.  Set to 300.

>           if (destlen<cplen) cplen = destlen;

destlen was less than cplen, so cplen is now 255.

>           if (cplen>255) cplen=255;

cplen remains at 255.

>           memcpy(dest, src, cplen);

255 characters are copied.

>           dest[cplen]='\0';

dest[255] is set to 0.  That's not good.  dest[0] to dest[254] are okay
to use, but not dest[255].  Yes, an overrun.

I had to think outside the box ...

char x[2];
x[0] is first char
x[1] is second char
x[2] is an overrun

-- 
James Cameron                                 (james.cameron AT compaq.com)

http://quozl.linux.org.au/         (or)         http://quozl.netrek.org/