FreeTDS Development Group

["James K. Lowden" <jklowden AT freetds.org>]

On Wed, 29 Feb 2012 08:58:39 -0800
<Mitchell_Freed AT McAfee.com> wrote:

> The error occurs in mem.c when trying to free the TDSLOGIN*. I
> noticed that the TDSLOGIN* allocated in tds_alloc_login is a
> different pointer than the one being passed to tds_free_login.
> Looking into it a bit closer the tds_free_login is failing on the
> TDSLOGIN* allocated from tds_alloc_connection -- if that helps.

On the error path from a connection failure, ct_connect() calls a host
of free_* routines, some of which call other freers, some through
pointers.  It's possible something goes wrong.  Not obvious, but
possible.  

You could attack it through your malloc(3).  Most C standard libraries
have ways to make invalid frees fail in a noisy way.  

Thanks for reporting the problem...

--jkl