Skip to Content.
Sympa Menu

freetds - [freetds] Strange assert

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Frediano Ziglio <freddyz77 AT tin.it>
  • To: FreeTDS <freetds AT lists.ibiblio.org>
  • Subject: [freetds] Strange assert
  • Date: 15 Mar 2003 12:23:18 +0100

I found a new, strange assert in dblib.c (dbconvert)

case -1: /* rtrim and null terminate */
for (i = len - 1; i >= 0 && dres.c[i] == ' '; --i) {
len = i;
}
assert(dres.c[len] == ' '); /* if last position
is not a blank, no
room to null terminate */
memcpy(dest, dres.c, len);
dest[len] = '\0';
ret = len;
break;

Why should dres.c contain space for terminator if copied and terminated
in copied buffer?
Also dres.c is not terminated, so this assert cause a core in some
condition (it's a read buffer overflow)...

freddy77





Archive powered by MHonArc 2.6.24.

Top of Page