bugreport: possible crash when reading empty text field from mssql database using odbc

problem is in function SQLGetData in odbc.c on line 4715 (in my version)

its this context, error line is marked with /*!!!*/

switch (nSybType) {
case SYBCHAR:
case SYBVARCHAR:
case SYBTEXT:
case XSYBCHAR:
case XSYBVARCHAR:
/*!!!*/	nread = (src[0] == '0' && toupper(src[1]) == 'X')? 2 : 0;  /*!!!*/
		
	while ((nread < colinfo->column_cur_size) && (src[nread] == ' ' || src[nread]
== '\0'))
		nread++;

	nread += colinfo->column_text_sqlgetdatapos * 2;
	
	if (nread && nread >= colinfo->column_cur_size)
		ODBC_RETURN(stmt, SQL_NO_DATA);


problem is that on my database i get:
nSybType = 35
colinfo.column_cur_size=0
src= 0x0

but its not recognized as empty or null value, instead it tries to read src[0]
and it causes crash

attached is patch which fixed issue for me, but of course i didn't studied
internals of freetds before doing it and i can't guarantee its correct, please,
someone review it...

_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds

--- odbc.c.orig	2009-12-04 14:47:39.000000000 +0100
+++ odbc.c	2009-12-07 12:26:23.709681867 +0100
@@ -4623,7 +4623,7 @@
 	}
 	colinfo = resinfo->columns[icol - 1];
 
-	if (colinfo->column_cur_size < 0) {
+	if (colinfo->column_cur_size <= 0) {
 		*pcbValue = SQL_NULL_DATA;
 	} else {
 		nSybType = tds_get_conversion_type(colinfo->column_type, colinfo->column_size);