FreeTDS Development Group

["Thompson, Bill D (London)" <ThompBil AT exchange.uk.ml.com>]

Freddy,

I found a small issue, which was causing (in some circumstances) varchar
data repeatedly fetched from the server to get corrupted.
In particular, if we retrieved 2 rows of varchar data, the first with
'AAAAAAAAAA', the second with 'BBB'
we would get returned into our bound variable 'AAAAAAAAAA', then
'BBBAAAAAAA'
It didn't happen in all cases, though.

I did the following fix in buffer_transfer_bound_data() in dblib.c :

before:


            if (is_blob_type(curcol->column_type)) {
                srclen =  curcol->column_cur_size;
                src = (BYTE *)curcol->column_textvalue;
            } else {
                src = ((BYTE *)buffer_row_address(buf, index))
                    + curcol->column_offset;
            }

after:

            srclen =  curcol->column_cur_size;

            if (is_blob_type(curcol->column_type)) {
                src = (BYTE *)curcol->column_textvalue;
            } else {
                src = ((BYTE *)buffer_row_address(buf, idx))
                    + curcol->column_offset;
            }

Without this, srclen was set to -1 .
This meant the subsequent call to dbconvert assumed the data was NULL
terminated, which it wasn't necessarily....

Bill

> -----Original Message-----
> From: Frediano Ziglio [SMTP:freddyz77 AT tin.it]
> Sent: 12 November 2002 22:49
> To:   TDS Development Group
> Subject:      [freetds] Bugs in dblib
> 
> I founded two bugs in dblib.
> 
> 1- calling dbconvert getting data binded do not initialize correctly
> dstlen. This can cause buffer overflow and/or wrong results
> 2- row buffering work copying row but do not handle text correctly (I
> think current version leak memory because it do not free rows correctly
> while some day ago version read current row text data only)
> 
> freddy77
> 
> 
> 
> ---
> You are currently subscribed to freetds as: [thompbil AT exchange.uk.ml.com]
> To unsubscribe, forward this message to
> $subst('Email.Unsub')