[freetds] [PATCH] 0.91 segfault in SQLTables

[Lionel Elie Mamane]

Hi,

Attached is the patch I apply to my local copy of FreeTDS. It solves a
segfault when connecting to MS SQL Server or Sybase SQL Anywhere from
LibreOffice, when LibreOffice calls SQLTables(). Also attached a
backtrace of the segfault.
--
Lionel
-------------- next part --------------
#0 0x00007fb82705365c in tds_quote (tds=0x33a3a20, buffer=0x0, quoting=93 ']', id=
0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>, len=1106707232) at query.c:2184
#1 0x00007fb82705378c in tds_quote_id (tds=0x33a3a20, buffer=0x0, id=0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>,
idlen=1106707232) at query.c:2222
#2 0x00007fb827027ff6 in odbc_stat_execute (stmt=0x34e9cc0, begin=0x7fb8270698cf "..sp_tables", nparams=4) at odbc.c:7049
#3 0x00007fb827027492 in _SQLTables (hstmt=0x34e9cc0, szCatalogName=0x34e5118 "APSAL", cbCatalogName=-3, szSchemaName=0x34e5138 "dbo",
cbSchemaName=-3, szTableName=0x34e4208 "ANALYTIC_VENTILATION", cbTableName=-3, szTableType=0x34e9ee8 "VIEW,TABLE,%,", cbTableType=-3)
at odbc.c:6793
#4 0x00007fb827026d3c in SQLTables (hstmt=0x34e9cc0, szCatalogName=0x34e5118 "APSAL", cbCatalogName=-3, szSchemaName=0x34e5138 "dbo",
cbSchemaName=-3, szTableName=0x34e4208 "ANALYTIC_VENTILATION", cbTableName=-3, szTableType=0x34e9ee8 "VIEW,TABLE,%,", cbTableType=-3)
at sqlwparams.h:113
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freetds.patch
Type: text/x-diff
Size: 510 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/freetds/attachments/20120802/6a704964/attachment.bin

[James K. Lowden]

On Thu, 2 Aug 2012 10:23:19 +0200

Post by Lionel Elie Mamane
Attached is the patch I apply to my local copy of FreeTDS. It solves a
segfault when connecting to MS SQL Server or Sybase SQL Anywhere from
LibreOffice, when LibreOffice calls SQLTables().

Applied with modification to master branch. A quick search for
param_qualifier in that function shows it's initialized to -1 and used
in that loop before being set. An index of -1 is rarely a good
idea. ;-)

Thanks for the patch!

--jkl