FreeTDS Development Group

["ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>]

Mm... a look more deeper to this function...

size_t
tds_strftime(char *buf, size_t maxsize, const char *format, const
TDSDATEREC * dr)
{
        struct tm tm;

        int length = 0;
        char *s, *our_format;
        char millibuf[8];

        char *pz = NULL;

        tm.tm_sec = dr->second;
        tm.tm_min = dr->minute;
        tm.tm_hour = dr->hour;
        tm.tm_mday = dr->day;
        tm.tm_mon = dr->month;
        tm.tm_year = dr->year - 1900;
        tm.tm_wday = dr->weekday;
        tm.tm_yday = dr->dayofyear;
        tm.tm_isdst = 0;
#ifdef HAVE_STRUCT_TM_TM_ZONE
        tm.tm_zone = NULL;
#elif defined(HAVE_STRUCT_TM___TM_ZONE)
        tm.__tm_zone = NULL;
#endif

        /* NOTE 2 in intentional. one more character is required because
we replace %z with 3 digits */
        our_format = (char *) malloc(strlen(format) + 2);
        if (!our_format)
                return 0;
        strcpy(our_format, format);

        pz = strstr(our_format, "%z");

        /*
         * Look for "%z" in the format string.  If found, replace it
with dr->milliseconds.
         * For example, if milliseconds is 124, the format string
         * "%b %d %Y %H:%M:%S.%z" would become
         * "%b %d %Y %H:%M:%S.124".
         */

        /* Skip any escaped cases (%%z) */

        while (pz && *(pz - 1) == '%')
                pz = strstr(++pz, "%z");


        if (pz && length < maxsize - 1) {

                sprintf(millibuf, "%03d", dr->millisecond);

                /* move everything back one, then overwrite "?%z" with
millibuf */
                for (s = our_format + strlen(our_format); s > pz; s--) {
                        *(s + 1) = *s;
                }

                strncpy(pz, millibuf, 3);       /* don't copy the null
*/
        }

        length = strftime(buf, maxsize, our_format, &tm);

        free(our_format);

        return length;
}


I don't understand the test "length < maxsize - 1". length is always 0
and I thing also this test is useless... also why we don't add support
for %e if platform is win32 (that do not support %e but support %d??)

I noted that 

   while (pz && *(pz - 1) == '%')
     pz = strstr(++pz, "%z");

can underflow (reading) if pz == our_format (that is format start with
"%z"). 

This line

   sprintf(millibuf, "%03d", dr->millisecond);

can overflow if millisecond is filled with an invalid value (think
-1234567890, it's TDS_INT).

Why also don't use memmove replacing

  for (s = our_format + strlen(our_format); s > pz; s--) {
    *(s + 1) = *s;
  }

with

  memmove(pz + 1, pz, strlen(pz)+1);

freddy77