Re: Buffer overflow in extract_diag_error_w()

On 11/11/15 10:22, Andrew Punch wrote:
> Hi,
>
> I rewrote the patch so that the message is truncated.
>
> diff -ur unixODBC-2.3.1/DriverManager/__info.c 
> unixodbc-2.3.1-patched/DriverManager/__info.c
> --- unixODBC-2.3.1/DriverManager/__info.c   2011-11-15 
> 22:43:15.000000000 +1100
> +++ unixodbc-2.3.1-patched/DriverManager/__info.c   2015-11-11 
> 20:16:24.585057248 +1100
> @@ -4460,7 +4460,7 @@
>              SQLWCHAR *tmp;
>
>  #ifdef STRICT_ODBC_ERROR
> -            wide_strcpy( msg, msg1 );
> +            wide_strncpy( msg, msg1, SQL_MAX_MESSAGE_LENGTH);
>  #else
>              tmp = ansi_to_unicode_alloc((SQLCHAR*) ERROR_PREFIX, 
> SQL_NTS, connection );
>              wide_strcpy( msg, tmp );
> @@ -4640,7 +4640,7 @@
>                  as1 = (SQLCHAR*) unicode_to_ansi_alloc( sqlstate, 
> SQL_NTS, connection );
>                  as2 = (SQLCHAR*) unicode_to_ansi_alloc( msg1, 
> SQL_NTS, connection );
>
> -                sprintf( connection -> msg, "\t\tDIAG [%s] %s",
> +                snprintf( connection -> msg, SQL_MAX_MESSAGE_LENGTH, 
> "\t\tDIAG [%s] %s",
>                          as1, as2 );
>
>                  if( as1 ) free( as1 );
> _______________________________________________
> unixODBC-dev mailing list
> [email protected]
> http://mailman.unixodbc.org/mailman/listinfo/unixodbc-dev

Ok, but how does a message string thats longer than 
SQL_MAX_MESSAGE_LENGTH come out of

         ret = SQLError(
                 henv,
                 hdbc,
                 hstmt,
                 sqlstate,
                 &native,
                 msg1,
                 sizeof( msg1 ),
                 &len );

Given that sizeof( msg1 ) == SQL_MAX_MESSAGE_LENGTH

Or an I still looking at different code to you in 2.3.1 and 2.3.5-pre?

-- 
Nick
_______________________________________________
unixODBC-dev mailing list
[email protected]
http://mailman.unixodbc.org/mailman/listinfo/unixodbc-dev