Bug #1012 Updated: Crash in SQLServer Image Column Conversion

ID: 1012 Updated by: sander@php.net Reported By: bro@mzv.net -Status: Open +Status: Bogus Bug Type: Sybase (dblib) related Operating System: Linux PHP Version: 3.0.6 New Comment: Thank you for taking the time to report a problem with PHP. Unfortunately, PHP 3 is no longer supported. Please download the latest version of PHP 4 from http://www.php.net/downloads.php If you are able to reproduce the bug with one of the latest versions of PHP, please change the PHP version on this bug report to the version you tested and change the status back to "Open". Again, thank you for your continued support of PHP. Previous Comments: ------------------------------------------------------------------------ [1999-12-13 15:50:38] joey@cvs.php.net Is this bug still there? ------------------------------------------------------------------------ [1998-12-29 09:58:27] bro@mzv.net php3_sybase_get_column_content in sybase.c (DB-Lib) crashes with buffer overflow when converting binary columns. The result of the IMAGE/VARBINARY to CHAR conversion is a hex string -> needs 2 bytes for each binary byte. The Patch below fixes this and also adds a bit more space for DATE conversions. Also works with MS-SQLServer. ---- cut ---- *** php-3.0.6/functions/sybase.c.orig Fri Sep 11 01:57:23 1998 --- php-3.0.6/functions/sybase.c Tue Dec 29 15:44:08 1998 *************** *** 637,639 **** char *res_buf; ! int res_length = dbdatlen(sybase_ptr->link,offset); register char *p; --- 637,640 ---- char *res_buf; ! int dat_length = dbdatlen(sybase_ptr->link,offset); ! int res_length = dat_length; register char *p; *************** *** 641,644 **** switch (coltype(offset)) { - case SYBBINARY: - case SYBVARBINARY: case SYBCHAR: --- 642,643 ---- *************** *** 646,648 **** --- 645,652 ---- case SYBTEXT: + break; + case SYBBINARY: + case SYBVARBINARY: case SYBIMAGE: + /* result is hex string */ + res_length = (dat_length * 2) + 4; break; *************** *** 650,652 **** /* take no chances, no telling how big the result would really be */ ! res_length += 20; break; --- 654,656 ---- /* take no chances, no telling how big the result would really be */ ! res_length += 40; break; *************** *** 655,657 **** res_buf = (char *) emalloc(res_length+1); ! dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset), res_length,SYBCHAR,res_buf,-1); --- 659,661 ---- res_buf = (char *) emalloc(res_length+1); ! res_length = dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset), dat_length,SYBCHAR,res_buf,-1); ---- cut ---- A Happy new year! Bernd ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=1012&edit=1