Skip to Content.
Sympa Menu

freetds - [freetds] Possible buffer overflow in ODBC driver

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: [freetds] Possible buffer overflow in ODBC driver
  • Date: Fri, 4 Nov 2005 14:59:10 +0100

The function odbc_get_string_size is used in odbc.c to get the size of
real string. For values of size <0 and different from SQL_NTS it can
happen to have a string not null with len <0. This can cause an integer
overflow (think int <0 converted to size_t) that can lead to a buffer
overflow. I don't know if DM have sufficient checks to prevent these
situations. You can find patch post 0.63 containing fix at
http://freetds.sourceforge.net/post63.diff.gz

freddy77



  • [freetds] Possible buffer overflow in ODBC driver, ZIGLIO, Frediano, VF-IT, 11/04/2005

Archive powered by MHonArc 2.6.24.

Top of Page