FreeTDS Development Group

["James K. Lowden" <jklowden AT speakeasy.org>]

"Mark J. Lilback" wrote:
> int  *tds, unsigned char *buf, int dsize, int ssize)
> {
> char *tempbuf;
> int  cpsize;
> 
>         tempbuf = (char *) malloc(dsize+1);
>         memset(tempbuf,'\0',dsize);
>         cpsize = ssize > dsize ? dsize : ssize;
>         memcpy(tempbuf,buf, cpsize);
>         tds_put_n(tds,(unsigned char*)tempbuf,dsize);
>         free(tempbuf);
>         return tds_put_byte(tds,cpsize);
> }

Hi Mark, 

FWIW, it's really a liability to have dsize and ssize defined as int. 
They should be size_t, unsigned ints.  I don't know why tds_put_buf
would be called with negative lengths, but memcpy would think it was
being called with a *very* big number.  

Since you asked, I suggest these lines before the malloc call:

if( dsize == 0 || ssize == 0 || buf == 0 )
        return 0;

assert( dsize > 0 );
assert( ssize > 0 );

...

>From looking at the code for 20 minutes, I can't see why tds_put_buf
would ever return anything except 0, and I can't see anything it needs
to do with a zero-length buffer.  

Just one man's opinion, of course.  

--jkl