Skip to Content.
Sympa Menu

freetds - segfault with TDS 7.0 login

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Lowden, James K" <LowdenJK AT bernstein.com>
  • To: "'TDS Development Group'" <freetds AT franklin.metalab.unc.edu>
  • Subject: segfault with TDS 7.0 login
  • Date: Tue, 6 Aug 2002 14:18:31 -0400


All,

I'm having trouble logging in with the current snapshot. Maybe things
aren't set up right (I think they are) but I'm having some trouble figuring
out what's wrong.

Environment is sqsh on NetBSD i386 to SQL Server 2000 with TDS 8.0 using the
Aug 6 snapshot.

Segfault occurs in tds/read.c, line 351, dereferencing a null tds->in_buf.

I've attached a patch to apply an assert to that pointer. I'm sure the
problem occurs earlier, but I don't know where to look, really. There's a
malloc for it just a few lines earlier, guarded by a test against
tds->in_buf_max, whose very large value appears to have been initialized
with -1.

Any suggestions? Here's the bt:

(gdb) p tds->in_buf
$2 = (unsigned char *) 0x0
(gdb) p tds->in_buf_max
$3 = 4294967288
(gdb) bt 9
#0 tds_read_packet (tds=0x8077800) at read.c:353
#1 0x4808fcd3 in tds_get_byte (tds=0x8077800) at read.c:119
#2 0x4808be66 in tds_process_login_tokens (tds=0x8077800) at token.c:179
#3 0x4808ed91 in tds_connect (login=0x807a000, context=0x8076f90,
parent=0x8079520) at login.c:288
#4 0x48088301 in ct_connect (con=0x8079520, servername=0x8076e80 "NTS0090",
snamelen=2) at ct.c:302
#5 0x804c723 in cmd_connect (argc=1, argv=0x8078300) at cmd_connect.c:577
#6 0x805dcf8 in jobset_run (js=0x8076e30, cmd_line=0x8063a12 "\\connect",
exit_status=0xbfbfd4c4) at sqsh_job.c:487
#7 0x80500a1 in cmd_loop (argc=1, argv=0x8078240) at cmd_loop.c:140
#8 0x805dcf8 in jobset_run (js=0x8076e30,
cmd_line=0x8067e7c "\\loop $script", exit_status=0xbfbfd750)
at sqsh_job.c:487
(More stack frames follow...)
(gdb) l
348 /* Set the new maximum packet size */
349 tds->in_buf_max = len;
350 }
351
352 /* Clean out the in_buf so we don't use old stuff by mistake
*/
353 assert( tds->in_buf );
354 memset(tds->in_buf, 0, tds->in_buf_max);
355
356 /* Now get exactly how many bytes the server told us to get
*/
357 have=0;

Here's the patch:

--- read.c.orig Tue Aug 6 08:48:35 2002
+++ read.c Tue Aug 6 08:35:14 2002
@@ -17,7 +17,9 @@
* Boston, MA 02111-1307, USA.
*/

+#include <assert.h>
#include <config.h>
+
#include "tds.h"
#ifdef DMALLOC
#include <dmalloc.h>
@@ -348,6 +350,7 @@
}

/* Clean out the in_buf so we don't use old stuff by mistake */
+ assert( tds->in_buf );
memset(tds->in_buf, 0, tds->in_buf_max);

/* Now get exactly how many bytes the server told us to get */

--jkl


The information contained in this transmission may contain privileged and
confidential information and is intended only for the use of the person(s)
named above. If you are not the intended recipient, or an employee or agent
responsible for delivering this message to the intended recipient, any
review, dissemination, distribution or duplication of this communication is
strictly prohibited. If you are not the intended recipient, please contact
the sender immediately by reply e-mail and destroy all copies of the
original message. Please note that for certain accounts we do not accept
orders and/or instructions by e-mail, and for those accounts we will not be
responsible for carrying out such orders and/or instructions. Kindly refrain
from sending orders or instructions by e-mail unless you have confirmed that
we accept such communications for your account. Please also note that to
satisfy regulatory requirements we review the outgoing and incoming e-mail
correspondence of staff members serving certain functions.






Archive powered by MHonArc 2.6.24.

Top of Page