#43861 [Opn->Fbk]: suhosin patch detects heap overflow on mssql_free_result()

ID: 43861 Updated by: jani@php.net Reported By: skennedy at vcn dot com -Status: Open +Status: Feedback Bug Type: MSSQL related Operating System: FreeBSD 6.2 PHP Version: 5.2.5 -Assigned To: +Assigned To: fb-req-jani New Comment: But did you apply the patch Ilia mentions above? Try again using current 5.3 snapshot. (and if that patch still applies, try it..) btw. That last url to some output you posted is no longer valid.. Previous Comments: ------------------------------------------------------------------------ [2008-03-04 18:45:50] skennedy at vcn dot com Sorry for not getting this done sooner. I got a PHP 5.3 snapshot and compiled/installed it and ran it through valgrind with the USE_ZEND_ALLOC env var set to 0 and here is the output: http://www.bandwidthbuilders.com/valgrind-output-nozendalloc-php5.3.txt ------------------------------------------------------------------------ [2008-02-10 14:50:28] iliaa@php.net Can you please try a CVS snapshot on PHP 5.3.0 in about 4-5 hours. I've just applied a patch to the code that may fix your problem. Alternatively you can try the patch yourself from this URL; http://cvs.php.net/viewvc.cgi/php-src/ext/mssql/php_mssql.c? r1=1.152.2.13.2.4.2.3&r2=1.152.2.13.2.4.2.4&diff_format=u ------------------------------------------------------------------------ [2008-02-10 07:57:04] cxcxcxcx at gmail dot com I have encountered a similar problem. When "select" contains 'smalldatetime' or 'datetime' columns. I am using Debian Sid and php5 php5-sybase. ------------------------------------------------------------------------ [2008-01-31 00:16:10] rasmus@php.net Ok, there we go. Looks like there is an off-by-one in there. But looking at the PHP code, it seems ok. int res_length = dbdatlen(mssql_ptr->link,offset); ... res_buf = (unsigned char *) emalloc(res_length+1); res_length = dbconvert(NULL,coltype(offset),dbdata(mssql_ptr->link,offset), res_length, SQLCHAR,res_buf,-1); res_buf[res_length] = '\0'; So, we aren't going beyond the buffer, it is somewhere in the dbconvert() code writing to res_buf that is off. Passing in a larger buffer would fix it, but it would be good to understand why dbdatlen() isn't returning the right length. Is it an encoding issue? One assumes single-byte encoding and the other multi-byte or something? Looping in Frank to have a look. ------------------------------------------------------------------------ [2008-01-30 21:23:02] skennedy at vcn dot com Okay, here is that: http://www.bandwidthbuilders.com/valgrind-output-nozendalloc.txt ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/43861 -- Edit this bug report at http://bugs.php.net/?id=43861&edit=1