Re: Buffer overflow in extract_diag_error_w()

Hi,

I rewrote the patch so that the message is truncated.

diff -ur unixODBC-2.3.1/DriverManager/__info.c 
unixodbc-2.3.1-patched/DriverManager/__info.c
--- unixODBC-2.3.1/DriverManager/__info.c   2011-11-15 
22:43:15.000000000 +1100
+++ unixodbc-2.3.1-patched/DriverManager/__info.c   2015-11-11 
20:16:24.585057248 +1100
@@ -4460,7 +4460,7 @@
              SQLWCHAR *tmp;

  #ifdef STRICT_ODBC_ERROR
-            wide_strcpy( msg, msg1 );
+            wide_strncpy( msg, msg1, SQL_MAX_MESSAGE_LENGTH);
  #else
              tmp = ansi_to_unicode_alloc((SQLCHAR*) ERROR_PREFIX, 
SQL_NTS, connection );
              wide_strcpy( msg, tmp );
@@ -4640,7 +4640,7 @@
                  as1 = (SQLCHAR*) unicode_to_ansi_alloc( sqlstate, 
SQL_NTS, connection );
                  as2 = (SQLCHAR*) unicode_to_ansi_alloc( msg1, SQL_NTS, 
connection );

-                sprintf( connection -> msg, "\t\tDIAG [%s] %s",
+                snprintf( connection -> msg, SQL_MAX_MESSAGE_LENGTH, 
"\t\tDIAG [%s] %s",
                          as1, as2 );

                  if( as1 ) free( as1 );
_______________________________________________
unixODBC-dev mailing list
[email protected]
http://mailman.unixodbc.org/mailman/listinfo/unixodbc-dev