FreeTDS Development Group

["Lowden, James K" <james.k.lowden AT alliancebernstein.com>]

> From: Frank M. Kromann
> Sent: Wednesday, March 07, 2007 12:33 PM
> 
> There seams to be a buffer overflow problem in Microsoft version
> of dbopen() (ntwdblib.dll). I'm trying to create a fix for this in
> the PHP extension and would like to know if there are any limit to
> the length of the servername (second parameter) in the FreeTDS
> version of this function?

Hi Frank, 

No.  The servername is placed in TDSLOGIN::server_name, which is a DSTR
type, a structure consisting of a pointer and a length.  The length is
the strlen() of the argument; that much memory is allocated and the name
copied to it.  There's no opportunity for a buffer overflow.  

When the servername is sent to the server in the login packet, it's
preceded by its length.  In the DSTR the length is an int; in the login
packet it's 16 bits.  Nothing prevents the caller from proposing a
servername with a length of 30 bits.  When the login packet is sent, it
will be malformed, having a servername length of only 16 bits
(effectively "& 0xFFFF") and the *whole* servername.  The only response
I've ever heard of by the server to a malformed login packet is a
rejected connection.  

HTH.  Thanks for your work.  

--jkl

-----------------------------------------
The information contained in this transmission may be privileged and
confidential and is intended only for the use of the person(s) named
above. If you are not the intended recipient, or an employee or agent 
responsible
for delivering this message to the intended recipient, any review, 
dissemination,
distribution or duplication of this communication is strictly prohibited. If 
you are
not the intended recipient, please contact the sender immediately by reply 
e-mail
and destroy all copies of the original message. Please note that we do not 
accept
account orders and/or instructions by e-mail, and therefore will not be 
responsible
for carrying out such orders and/or instructions.  If you, as the intended 
recipient
of this message, the purpose of which is to inform and update our clients, 
prospects
and consultants of developments relating to our services and products, would 
not
like to receive further e-mail correspondence from the sender, please "reply" 
to the
sender indicating your wishes.  In the U.S.: 1345 Avenue of the Americas, New 
York,
NY 10105.