[PATCH] array subscript out of bounds in tds_process_login_tokens
"Craig A. Berry" <[email protected]>
| Newsgroups | gmane.comp.db.tds.freetds |
|---|---|
| Message-ID | <[email protected]> |
Someone forgot that C is C and the array subscripts start at zero, not 1. We might have been getting away with it because of internal padding in the structure, but that's scary and non-portable. ________________________________________ Craig A. Berry mailto:[email protected] "... getting out of a sonnet is much more difficult than getting in." Brad Leithauser _______________________________________________ FreeTDS mailing list [email protected] http://lists.ibiblio.org/mailman/listinfo/freetds
login_tokens.patch.txt
(text/plain, 1.2 KB)
Index: src/tds/token.c
===================================================================
RCS file: /cvsroot/freetds/freetds/src/tds/token.c,v
retrieving revision 1.383
diff -p -u -r1.383 token.c
--- src/tds/token.c 8 Apr 2010 08:19:16 -0000 1.383
+++ src/tds/token.c 7 May 2010 19:56:58 -0000
@@ -347,9 +347,9 @@ tds_process_login_tokens(TDSSOCKET * tds
ver.major = tds_get_byte(tds);
ver.minor = tds_get_byte(tds);
+ ver.tiny[0] = tds_get_byte(tds);
ver.tiny[1] = tds_get_byte(tds);
- ver.tiny[2] = tds_get_byte(tds);
- ver.reported = (ver.major << 24) | (ver.minor << 16) | (ver.tiny[1] << 8) | ver.tiny[2];
+ ver.reported = (ver.major << 24) | (ver.minor << 16) | (ver.tiny[0] << 8) | ver.tiny[1];
/* Log reported server product name, cf. MS-TDS LOGINACK documentation. */
switch(ver.reported) {
@@ -370,7 +370,7 @@ tds_process_login_tokens(TDSSOCKET * tds
}
tdsdump_log(TDS_DBG_FUNC, "server reports TDS version %x.%x.%x.%x\n",
- ver.major, ver.minor, ver.tiny[1], ver.tiny[2]);
+ ver.major, ver.minor, ver.tiny[0], ver.tiny[1]);
tdsdump_log(TDS_DBG_FUNC, "Product name for 0x%x is %s\n", ver.reported, ver.name);
/* Get server product name. */