Skip to Content.
Sympa Menu

freetds - Re: [freetds] freebcp from 0.64 segfaults on image fields

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] freebcp from 0.64 segfaults on image fields
  • Date: Fri, 11 Aug 2006 15:52:31 +0200

>
> Hi All,
>
> I noticed that attempt to bcp out a table with image column containing
> data >129bytes long causing freebcp's segfault:
>
> bash-2.05b$ uname -smr
> Linux 2.4.23-P4-4G i686
> bash-2.05b$ sqsh -S MSSQL0 -D testdb
> [101] MSSQL0.testdb.1> create table img(id int identity, data image)
> [101] MSSQL0.testdb.2> insert img (data) select replicate ('a',130)
> [101] MSSQL0.testdb.3> go
> bash-2.05b$ freebcp testdb.dbo.img out /tmp/foo.bcp -c -S
> MSSQL0 -U ... -P ...
>
> Starting copy...
>
> Segmentation fault
>
>
> Image fields of smaller size (129 bytes and less) work fine.
>

Confirmed!
bcp use dbconvert with -1 as destlen to not pad strings however making
so it cause a buffer overflow if string is longer that 256. In this case
converting from binary/image to char every byte is doubles ('a' -> '61')
so the buffer overflow occur. Always look twice at functions that take
pointers to buffer without length...

>
> In native mode (-n option), freebcp gives error:
>
> Msg 20053, Level 4
> Requested data conversion does not exist
>
>
> and produced data file doesn't seem to be right:
>
> bash-2.05b$ od -h /tmp/foo.bcp
> 0000000 ffff ffff
> 0000004
>
> Any idea what could be wrong?
>

I'll look even at native mode.

bye
freddy77





Archive powered by MHonArc 2.6.24.

Top of Page