Skip to Content.
Sympa Menu

freetds - Re: Buffer Overflow ?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Brian Bruns <camber AT ais.org>
  • To: TDS Development Group <freetds AT franklin.oit.unc.edu>
  • Subject: Re: Buffer Overflow ?
  • Date: Wed, 24 Jan 2001 18:35:41 -0500 (EST)



Technically it is defined by the API as length of dest, I don't have the
doc in front of me but I believe it is something like 'size of buffer
into which the data will be copied' (remember that tds_convert is called
by dbconvert, ct_convert and implicitly by binding a to a different type).

So there is an off by one error, and I'll apply the patch.

Brian

On Wed, 24 Jan 2001, Mark Schaal wrote:

>
> IMO, destlen should be the length of dest. However, Brian is the
> one who has the final say on this.
>
> Mark
>
> >
> > Now I understand better what the issue here is. Looking at this code more
> > closely, I see a point in tds_convert_binary() as well, where it's assumed
> > that dest[destlen] is writeable. However, in other parts of the same
> > function
> > it copies no more than 'destlen' bytes. What is the meaning of the
> > 'destlen'
> > argument? I find places in the code where it is used to mean 'the size of
> > dest', and places where it's used to mean 'the highest valid index of
> > dest[]'.
> > (about half of each) Which of these is the 'correct' meaning?
> >
> > If someone can tell me that, I'd be happy to audit the code and put
> > together a
> > patch that fixes the remaining off-by-one errors.
> >
> > Regards,
> > Steve Langasek
> > postmodern programmer
>
> --
> Mark J. Schaal Phone: (909)
> 620-7724
> TST On Ramp Fax: (909) 620-8174
> System Administrator E-Mail: mark AT tstonramp.com
>
> ---
> You are currently subscribed to freetds as: [camber AT ais.org]
> To unsubscribe, forward this message to $subst('Email.Unsub')
>






Archive powered by MHonArc 2.6.24.

Top of Page