FreeTDS Development Group

[Frediano Ziglio <freddyz77 AT tin.it>]

I found a new, strange assert in dblib.c (dbconvert)

                case -1:        /* rtrim and null terminate */
                        for (i = len - 1; i >= 0 && dres.c[i] == ' '; --i) {
                                len = i;
                        }
                        assert(dres.c[len] == ' ');     /* if last position 
is not a blank, no
room to null terminate */
                        memcpy(dest, dres.c, len);
                        dest[len] = '\0';
                        ret = len;
                        break;

Why should dres.c contain space for terminator if copied and terminated
in copied buffer?
Also dres.c is not terminated, so this assert cause a core in some
condition (it's a read buffer overflow)...

freddy77