Skip to Content.
Sympa Menu

freetds - Re: 0.60 + PHP + MSSQL2K segfault -- depends on the query (??)

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Frediano Ziglio <freddyz77 AT tin.it>
  • To: TDS Development Group <freetds AT franklin.oit.unc.edu>
  • Subject: Re: 0.60 + PHP + MSSQL2K segfault -- depends on the query (??)
  • Date: 16 Nov 2002 01:16:58 +0100


Il sab, 2002-11-16 alle 00:43, Lowden, James K ha scritto:
> > From: Frediano Ziglio [mailto:freddyz77 AT tin.it]
> > Sent: November 15, 2002 6:37 PM
> >
> > Il ven, 2002-11-15 alle 21:14, Paul Kiela ha scritto:
> > > Hey guys,
> > >
> > > Having a segfault problem getting data out of my MS-SQL
> > server using FreeTDS and PHP.
>
> > Only a question. Are there a numeric field in Orders table ?
>
> No, see my lengthy reply. :)
>

Opss...
See this code (PHP 4.2.3, ext/sybase)

if (dbwillconvert(coltype(offset),SYBCHAR)) {
char *res_buf;
int res_length = dbdatlen(sybase_ptr->link,offset);
register char *p;

switch (coltype(offset)) {
case SYBBINARY:
case SYBVARBINARY:
case SYBCHAR:
case SYBVARCHAR:
case SYBTEXT:
case SYBIMAGE:
break;
default:
/* take no chances, no telling how big the result would really be */
res_length += 20;
break;
}

res_buf = (char *) emalloc(res_length+1);
memset(res_buf,' ',res_length+1); /* XXX i'm sure there's a better
way

but i don't have sybase here to test

991105 thies AT thieso.net */

dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset),
res_length,SYBCHAR,res_buf,-1);

Converting binary -> char PHP allocate only length+1 bytes of binary but
conversion binary -> char require 2*length bytes (plus terminator), do
it's a buffer overflow.
So, or PHP is wrong and should allocate more space or FreeTDS dblib is
wrong and conversion binary -> char should just do a memcpy instead of
converting to hexadecimal...

freddy77






Archive powered by MHonArc 2.6.24.

Top of Page