FreeTDS Development Group

["ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>]

> > 
> > Luke Benstead wrote:
> > > 
> > > I'm using 0.64. The bug doesn't occur with 0.63 but I get a 
> > different
> > > bug (duplicate rows returned when there is a warning) with 
> > 0.63 that is
> > > fixed in 0.64 :)
> > 
> >     :-)  And this will be fixed, too, soon.  
> > 
> > > Setting a text-size does get rid of the crazy numbers, 
> > setting a text
> > > size of 4000 in freetds.conf, sets the Server column size 
> > to 4000 and
> > > the client one to 8000. Either way the bug still occurs.
> > 
> > I.e., it still crashes?  
> > 
> > > The field is an ntext field that is empty (i.e a blank 
> > string, not NULL)
> > 
> > Thanks.  I think we should add this to our unit tests.  From your
> > description it sounds like a server bug.  Where I come from 
> > zero-length
> > strings have a length of zero, not infinite.  But mine is 
> basically a
> > Newtonian existence....
> > 
> 
> Try using 
> 
> static int
> determine_adjusted_size(const TDSICONV * char_conv, int size)
> {
>         if (!char_conv)
>                 return size;
> 
>         if (size >= 0x10000000)
>                 return 0x2fffffff;
> 
>         size *= char_conv->client_charset.max_bytes_per_char;
>         if (size % char_conv->server_charset.min_bytes_per_char)
>                 size += char_conv->server_charset.min_bytes_per_char;
>         size /= char_conv->server_charset.min_bytes_per_char;
> 
>         return size;
> }
> 
> (src/tds/token.c) this should avoid overflow.
> 

I managed to reproduce the bug... Yes, it's a integer overflow problem
:(
Fixed in both branchs (CVS HEAD and 0.64, post 0.64 patch updated)

Looking at the code another time perhaps it would be better to divide
before multiply but it's only my paranoia :)

freddy77