FreeTDS Development Group

[KC <kcc1967 AT gmail.com>]

Hi,

I think I found a bug for freetds-0.63.
In file freetds-0.63/src/tds/query.c line 1134~1144, function
tds_put_data(), the orignal code is:

..........................
#ifdef WORDS_BIGENDIAN
            unsigned char buf[64];

            if (tds->emul_little_endian && colsize < 64) {
                tdsdump_log(TDS_DBG_INFO1, "swapping coltype %d\n",
                        tds_get_conversion_type(curcol->column_type, 
colsize));
                memcpy(buf, s, colsize);
               
tds_swap_datatype(tds_get_conversion_type(curcol->column_type,
colsize), buf);
                s = buf;
            }
#endif
............................

The "s = buf;" should be replaced by "memcpy(s,buf,colsize);",
since "buf" is local which is not allocated by malloc().   Use "s=buf"
will cause following tds_convert_string_free((char*)src, s) try
to free "s" ... and that will cause Segmentation Fault.


Regards,
KC

kccheng AT LinuxDAQ-Labs.org