freetds AT lists.ibiblio.org
Subject: FreeTDS Development Group
List archive
- From: Mark Schaal <mark AT champ.tstonramp.com>
- To: freetds AT franklin.oit.unc.edu
- Subject: Re: Buffer Overflow ?
- Date: Wed, 24 Jan 2001 14:13:05 -0800 (PST)
IMO, destlen should be the length of dest. However, Brian is the
one who has the final say on this.
Mark
>
> Now I understand better what the issue here is. Looking at this code more
> closely, I see a point in tds_convert_binary() as well, where it's assumed
> that dest[destlen] is writeable. However, in other parts of the same
> function
> it copies no more than 'destlen' bytes. What is the meaning of the
> 'destlen'
> argument? I find places in the code where it is used to mean 'the size of
> dest', and places where it's used to mean 'the highest valid index of
> dest[]'.
> (about half of each) Which of these is the 'correct' meaning?
>
> If someone can tell me that, I'd be happy to audit the code and put
> together a
> patch that fixes the remaining off-by-one errors.
>
> Regards,
> Steve Langasek
> postmodern programmer
--
Mark J. Schaal Phone: (909) 620-7724
TST On Ramp Fax: (909) 620-8174
System Administrator E-Mail: mark AT tstonramp.com
-
Buffer Overflow ?,
Claudio Cicali, 01/18/2001
- <Possible follow-up(s)>
- Re: Buffer Overflow ?, Steve Langasek, 01/23/2001
-
Re: Buffer Overflow ?,
Claudio Cicali, 01/23/2001
- Re: Buffer Overflow ?, Steve Langasek, 01/23/2001
- Re: Buffer Overflow ?, James Cameron, 01/23/2001
- Re: Buffer Overflow ?, Mark Schaal, 01/24/2001
- Re: Buffer Overflow ?, Brian Bruns, 01/24/2001
- Re: Buffer Overflow ?, Steve Langasek, 01/25/2001
- Re: Buffer Overflow ?, Brian Bruns, 01/25/2001
Archive powered by MHonArc 2.6.24.