freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

[freetds] [PATCH] array subscript out of bounds in tds_process_login_tokens

From: "Craig A. Berry" <craigberry AT mac.com>
To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
Subject: [freetds] [PATCH] array subscript out of bounds in tds_process_login_tokens
Date: Fri, 07 May 2010 15:12:02 -0500

Someone forgot that C is C and the array subscripts start at zero, not 1. We might have been getting away with it because of internal padding in the structure, but that's scary and non-portable.

________________________________________
Craig A. Berry
mailto:craigberry AT mac.com

"... getting out of a sonnet is much more
difficult than getting in."
Brad Leithauser

Index: src/tds/token.c
===================================================================
RCS file: /cvsroot/freetds/freetds/src/tds/token.c,v
retrieving revision 1.383
diff -p -u -r1.383 token.c
--- src/tds/token.c 8 Apr 2010 08:19:16 -0000 1.383
+++ src/tds/token.c 7 May 2010 19:56:58 -0000
@@ -347,9 +347,9 @@ tds_process_login_tokens(TDSSOCKET * tds

ver.major = tds_get_byte(tds);
ver.minor = tds_get_byte(tds);
+ ver.tiny[0] = tds_get_byte(tds);
ver.tiny[1] = tds_get_byte(tds);
- ver.tiny[2] = tds_get_byte(tds);
- ver.reported = (ver.major << 24) | (ver.minor << 16)
| (ver.tiny[1] << 8) | ver.tiny[2];
+ ver.reported = (ver.major << 24) | (ver.minor << 16)
| (ver.tiny[0] << 8) | ver.tiny[1];

/* Log reported server product name, cf. MS-TDS
LOGINACK documentation. */
switch(ver.reported) {
@@ -370,7 +370,7 @@ tds_process_login_tokens(TDSSOCKET * tds
}

tdsdump_log(TDS_DBG_FUNC, "server reports TDS version
%x.%x.%x.%x\n",
- ver.major, ver.minor,
ver.tiny[1], ver.tiny[2]);
+ ver.major, ver.minor,
ver.tiny[0], ver.tiny[1]);
tdsdump_log(TDS_DBG_FUNC, "Product name for 0x%x is
%s\n", ver.reported, ver.name);

/* Get server product name. */

[freetds] [PATCH] array subscript out of bounds in tds_process_login_tokens, Craig A. Berry, 05/07/2010
- Re: [freetds] [PATCH] array subscript out of bounds in tds_process_login_tokens, jklowden, 05/07/2010