Skip to Content.
Sympa Menu

freetds - RE: [freetds] Crash in APACHE/PHP(compiled with sybase-ct) and FreeTDS 0.62.dev.20030714

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Ben Vaughn" <bvaughn AT BlackbirdTech.com>
  • To: <freetds AT lists.ibiblio.org>
  • Subject: RE: [freetds] Crash in APACHE/PHP(compiled with sybase-ct) and FreeTDS 0.62.dev.20030714
  • Date: Mon, 21 Jul 2003 17:20:37 -0400

Strangely enough, getting out of that build fixed my issues. I'll
recompile that build with your patch tomorrow and see what happens. My
client is FreeBSD 4.8-STABLE, 2.0GHz P4, 2G RAM. Sybase is a Single
P3-1.13Ghz , 2G RAM, running Win2k Server.

Thanks for your help,
Ben

------
Ben Vaughn
Security Analyst
Blackbird Technologies
703-796-1438 W / 703-582-4551 C
bvaughn AT blackbirdtech.com
------


-----Original Message-----
From: Lowden, James K [mailto:LowdenJK AT bernstein.com]
Sent: Monday, July 21, 2003 04:38
To: 'FreeTDS Development Group'
Subject: RE: [freetds] Crash in APACHE/PHP(compiled with sybase-ct) and
FreeTDS 0.62.dev.20030714


> From: Ben Vaughn [mailto:bvaughn AT BlackbirdTech.com]
> Sent: July 21, 2003 12:36 PM
>
> A new apache bug springs to life!

Looks like ours, unfortunately, but I don't see anything wrong with the
code.

> Program received signal SIGBUS, Bus error.
> 0x284cf2ad in tds_numeric_to_string (numeric=0x81b4564,
> s=0xbfbfda00 ",ê\034\b") at numeric.c:279
> 279 *--pnum = number[n - 1] * 256 + number[n];
> (gdb) bt
> #0 0x284cf2ad in tds_numeric_to_string (numeric=0x81b4564,
> s=0xbfbfda00 ",ê\034\b") at numeric.c:279
> #1 0x284ca9b5 in tds_convert_numeric (srctype=108,

What's the hardware and OS of the client, Ben?

A bus error is usually an alignment problem, but we're not doing anything
fancy on line 279. We're taking an unsigned char and implicitly promoting
it to an int (* 256), adding another unsigned char to it, and assigning it
to an unsigned in. Seems safe enough to me. Maybe it should be:

*--pnum = (unsigned int) number[n - 1] << 8 | number[n];

You could try other casts, or the attached patch, which is a little more
verbose but separates the steps and avoids the multiplication. Please let
me know if it works; I won't commit it otherwise.

--jkl

-----------------------------------------
The information contained in this transmission may contain privileged and
confidential information and is intended only for the use of the person(s)
named above. If you are not the intended recipient, or an employee or
agent responsible for delivering this message to the intended recipient,
any review, dissemination, distribution or duplication of this
communication is strictly prohibited. If you are not the intended
recipient, please contact the sender immediately by reply e-mail and
destroy all copies of the original message. Please note that we do not
accept account orders and/or instructions by e-mail, and therefore will
not be responsible for carrying out such orders and/or instructions.




Archive powered by MHonArc 2.6.24.

Top of Page