FreeTDS Development Group

[Steve Langasek <vorlon AT netexpress.net>]

Hi Claudio,

Now I understand better what the issue here is.  Looking at this code more
closely, I see a point in tds_convert_binary() as well, where it's assumed
that dest[destlen] is writeable.  However, in other parts of the same function
it copies no more than 'destlen' bytes.  What is the meaning of the 'destlen'
argument?  I find places in the code where it is used to mean 'the size of
dest', and places where it's used to mean 'the highest valid index of dest[]'.
(about half of each)  Which of these is the 'correct' meaning?

If someone can tell me that, I'd be happy to audit the code and put together a
patch that fixes the remaining off-by-one errors.

Regards,
Steve Langasek
postmodern programmer

On Wed, 24 Jan 2001, Claudio Cicali wrote:

> First of all this considerations are only *potentially* dangerous, imho.
> I've not walked throw the code of freetds to see if this really can happens.
> I'll make an example.

> Let's try this :

> char dest[255];  // I suppose that if I call a function which accepts
>                   // the length of the output buffer, that function never
>                   // write beyond this limit...

> TDS_INT tds_convert_text(srctype, src, 300, SYBCHAR, dest, sizeof(dest));

> // 300 is used just to have a > 255 srclen

> > >        case SYBCHAR:
> > >           cplen = srclen;

> cplen == 300

> > >           if (destlen<cplen) cplen = destlen;

> cplen == 255

> > >           if (cplen>255) cplen=255;

> cplen == 255

> > >           memcpy(dest, src, cplen);

> This is ok; dest is 255 bytes long, cplen is 255 too.

> > >           dest[cplen]='\0';

> This is wrong. You are writing the 256th byte.