Skip to Content.
Sympa Menu

freetds - Re: Buffer Overflow ?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Steve Langasek <vorlon AT netexpress.net>
  • To: Claudio Cicali <c.cicali AT mclink.it>
  • Cc: freetds AT franklin.oit.unc.edu
  • Subject: Re: Buffer Overflow ?
  • Date: Tue, 23 Jan 2001 22:03:55 -0600 (CST)


Hi Claudio,

Now I understand better what the issue here is. Looking at this code more
closely, I see a point in tds_convert_binary() as well, where it's assumed
that dest[destlen] is writeable. However, in other parts of the same function
it copies no more than 'destlen' bytes. What is the meaning of the 'destlen'
argument? I find places in the code where it is used to mean 'the size of
dest', and places where it's used to mean 'the highest valid index of dest[]'.
(about half of each) Which of these is the 'correct' meaning?

If someone can tell me that, I'd be happy to audit the code and put together a
patch that fixes the remaining off-by-one errors.

Regards,
Steve Langasek
postmodern programmer

On Wed, 24 Jan 2001, Claudio Cicali wrote:

> First of all this considerations are only *potentially* dangerous, imho.
> I've not walked throw the code of freetds to see if this really can happens.
> I'll make an example.

> Let's try this :

> char dest[255]; // I suppose that if I call a function which accepts
> // the length of the output buffer, that function never
> // write beyond this limit...

> TDS_INT tds_convert_text(srctype, src, 300, SYBCHAR, dest, sizeof(dest));

> // 300 is used just to have a > 255 srclen

> > > case SYBCHAR:
> > > cplen = srclen;

> cplen == 300

> > > if (destlen<cplen) cplen = destlen;

> cplen == 255

> > > if (cplen>255) cplen=255;

> cplen == 255

> > > memcpy(dest, src, cplen);

> This is ok; dest is 255 bytes long, cplen is 255 too.

> > > dest[cplen]='\0';

> This is wrong. You are writing the 256th byte.





Archive powered by MHonArc 2.6.24.

Top of Page