Skip to Content.
Sympa Menu

freetds - Re: Buffer Overflow ?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Mark Schaal <mark AT champ.tstonramp.com>
  • To: freetds AT franklin.oit.unc.edu
  • Subject: Re: Buffer Overflow ?
  • Date: Wed, 24 Jan 2001 14:13:05 -0800 (PST)



IMO, destlen should be the length of dest. However, Brian is the
one who has the final say on this.

Mark

>
> Now I understand better what the issue here is. Looking at this code more
> closely, I see a point in tds_convert_binary() as well, where it's assumed
> that dest[destlen] is writeable. However, in other parts of the same
> function
> it copies no more than 'destlen' bytes. What is the meaning of the
> 'destlen'
> argument? I find places in the code where it is used to mean 'the size of
> dest', and places where it's used to mean 'the highest valid index of
> dest[]'.
> (about half of each) Which of these is the 'correct' meaning?
>
> If someone can tell me that, I'd be happy to audit the code and put
> together a
> patch that fixes the remaining off-by-one errors.
>
> Regards,
> Steve Langasek
> postmodern programmer

--
Mark J. Schaal Phone: (909) 620-7724
TST On Ramp Fax: (909) 620-8174
System Administrator E-Mail: mark AT tstonramp.com




Archive powered by MHonArc 2.6.24.

Top of Page