mdb-export problem and fix

Pete Yadlowsky <[email protected]>
Newsgroups gmane.comp.db.mdb-tools.devel
Message-ID <[email protected]>
Hi,

I'm running mdbtools-0.6pre1. I have a Jet4 MDB file that mdb-export was 
having some trouble reading. It would get about halfway through the 
rows, then die with a segfault. Using gdb, I traced the problem to line 
1062 in  src/libmdb/data.c. The segfault was in a call to strncpy(). 
Specifically,


if (mdb->pg_buf[start]==0xff &&
		mdb->pg_buf[start+1]==0xfe) {
	strncpy(text, &mdb->pg_buf[start+2], size-2);
	text[size-2]='\0';

At the top of the containing routine, "text" is declared:

         static char text[MDB_BIND_SIZE];

It occurred to me that "size-2" might be evaluating to something greater 
than MDB_BIND_SIZE for whatever reason, so I injected a little code 
before the strncpy() call to limit the size parameter to MDB_BIND_SIZE. 
The segfault went away and mdb-export ran successfully. In doing this, I 
may be truncating a chunk of incoming MDB data, but I'll worry about 
that later. Just thought someone might want to know about this, if it's 
not already known.


-- 
Pete Yadlowsky
ITC Unix Systems Support
University of Virginia
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.