freetds AT lists.ibiblio.org
Subject: FreeTDS Development Group
List archive
Re: 0.60 + PHP + MSSQL2K segfault -- depends on the query (??)
- From: Frediano Ziglio <freddyz77 AT tin.it>
- To: TDS Development Group <freetds AT franklin.oit.unc.edu>
- Subject: Re: 0.60 + PHP + MSSQL2K segfault -- depends on the query (??)
- Date: 16 Nov 2002 01:16:58 +0100
Il sab, 2002-11-16 alle 00:43, Lowden, James K ha scritto:
> > From: Frediano Ziglio [mailto:freddyz77 AT tin.it]
> > Sent: November 15, 2002 6:37 PM
> >
> > Il ven, 2002-11-15 alle 21:14, Paul Kiela ha scritto:
> > > Hey guys,
> > >
> > > Having a segfault problem getting data out of my MS-SQL
> > server using FreeTDS and PHP.
>
> > Only a question. Are there a numeric field in Orders table ?
>
> No, see my lengthy reply. :)
>
Opss...
See this code (PHP 4.2.3, ext/sybase)
if (dbwillconvert(coltype(offset),SYBCHAR)) {
char *res_buf;
int res_length = dbdatlen(sybase_ptr->link,offset);
register char *p;
switch (coltype(offset)) {
case SYBBINARY:
case SYBVARBINARY:
case SYBCHAR:
case SYBVARCHAR:
case SYBTEXT:
case SYBIMAGE:
break;
default:
/* take no chances, no telling how big the result would really be */
res_length += 20;
break;
}
res_buf = (char *) emalloc(res_length+1);
memset(res_buf,' ',res_length+1); /* XXX i'm sure there's a better
way
but i don't have sybase here to test
991105 thies AT thieso.net */
dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset),
res_length,SYBCHAR,res_buf,-1);
Converting binary -> char PHP allocate only length+1 bytes of binary but
conversion binary -> char require 2*length bytes (plus terminator), do
it's a buffer overflow.
So, or PHP is wrong and should allocate more space or FreeTDS dblib is
wrong and conversion binary -> char should just do a memcpy instead of
converting to hexadecimal...
freddy77
-
Re: 0.60 + PHP + MSSQL2K segfault -- depends on the query (??),
Frediano Ziglio, 11/15/2002
- <Possible follow-up(s)>
- Re: 0.60 + PHP + MSSQL2K segfault -- depends on the query (??), Frediano Ziglio, 11/15/2002
- Re: 0.60 + PHP + MSSQL2K segfault -- depends on the query (??), Frediano Ziglio, 11/15/2002
Archive powered by MHonArc 2.6.24.