FreeTDS Development Group

["Frank M. Kromann" <frank AT kromann.info>]

Thanks James,

That was my understanding too.

I'll make the changes to the PHP extension so they are included only when
linked with Microsofts ntwdblib.lib.

- Frank

> > From: Frank M. Kromann
> > Sent: Wednesday, March 07, 2007 12:33 PM
> > 
> > There seams to be a buffer overflow problem in Microsoft version
> > of dbopen() (ntwdblib.dll). I'm trying to create a fix for this in
> > the PHP extension and would like to know if there are any limit to
> > the length of the servername (second parameter) in the FreeTDS
> > version of this function?
> 
> Hi Frank, 
> 
> No.  The servername is placed in TDSLOGIN::server_name, which is a DSTR
> type, a structure consisting of a pointer and a length.  The length is
> the strlen() of the argument; that much memory is allocated and the
name
> copied to it.  There's no opportunity for a buffer overflow.  
> 
> When the servername is sent to the server in the login packet, it's
> preceded by its length.  In the DSTR the length is an int; in the login
> packet it's 16 bits.  Nothing prevents the caller from proposing a
> servername with a length of 30 bits.  When the login packet is sent, it
> will be malformed, having a servername length of only 16 bits
> (effectively "& 0xFFFF") and the *whole* servername.  The only response
> I've ever heard of by the server to a malformed login packet is a
> rejected connection.  
> 
> HTH.  Thanks for your work.  
> 
> --jkl
> 
> -----------------------------------------
> The information contained in this transmission may be privileged and
> confidential and is intended only for the use of the person(s) named
> above. If you are not the intended recipient, or an employee or agent
responsible
> for delivering this message to the intended recipient, any review,
dissemination,
> distribution or duplication of this communication is strictly
prohibited. If you are
> not the intended recipient, please contact the sender immediately by
reply e-mail
> and destroy all copies of the original message. Please note that we do
not accept
> account orders and/or instructions by e-mail, and therefore will not be
responsible
> for carrying out such orders and/or instructions.  If you, as the
intended recipient
> of this message, the purpose of which is to inform and update our
clients, prospects
> and consultants of developments relating to our services and products,
would not
> like to receive further e-mail correspondence from the sender, please
"reply" to the
> sender indicating your wishes.  In the U.S.: 1345 Avenue of the
Americas, New York,
> NY 10105.
> 
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>