FreeTDS Development Group

["ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>]

The function odbc_get_string_size is used in odbc.c to get the size of
real string. For values of size <0 and different from SQL_NTS it can
happen to have a string not null with len <0. This can cause an integer
overflow (think int <0 converted to size_t) that can lead to a buffer
overflow. I don't know if DM have sufficient checks to prevent these
situations. You can find patch post 0.63 containing fix at
http://freetds.sourceforge.net/post63.diff.gz

freddy77