FreeTDS Development Group

["Castellano, Nicholas" <Nicholas_Castellano AT acml.com>]

IMNSHO, we need fewer statically-sized buffers, not more.  Let's learn a
lesson from the last umpteen years of buffer overflow security exploits and
do the right thing, even if it is more work.

And assert() isn't a reasonable runtime check in any case.  It's only
intended to be a debugging tool, to be disabled in production code by
"#define NDEBUG".

--nick

-----Original Message-----
From: bounce-freetds-145195 AT franklin.oit.unc.edu
[mailto:bounce-freetds-145195 AT franklin.oit.unc.edu] 
Sent: Monday, September 16, 2002 11:30 AM
To: TDS Development Group
Subject: [freetds] RE: DBLIB Unit Tests failing again

[...]
Manipulation of TDSLOCINFO is made more complicated by its design: it
consists of three char* pointers.  I'd be tempted to make them char[64], and
use assert() when reading freetds.conf to make sure the language, char_set,
and date_fmt all fit.  Valid specifications of these fields would never be
anywhere close to 64 bytes.  ("Char 64, where are you?"?)  Does anyone see a
problem with that?  
[...]


The information contained in this transmission may contain privileged and
confidential information and is intended only for the use of the person(s)
named above.  If you are not the intended recipient, or an employee or agent
responsible for delivering this message to the intended recipient, any
review, dissemination, distribution or duplication of this communication is
strictly prohibited. If you are not the intended recipient, please contact
the sender immediately by reply e-mail and destroy all copies of the
original message. Please note that for certain accounts we do not accept
orders and/or instructions by e-mail, and for those accounts we will not be
responsible for carrying out such orders and/or instructions. Kindly refrain
from sending orders or instructions by e-mail unless you have confirmed that
we accept such communications for your account. Please also note that to
satisfy regulatory requirements we review the outgoing and incoming e-mail
correspondence of staff members serving certain functions.