Bug #1012: Crash in SQLServer Image Column Conversion

From: bro@mzv.net Operating system: Linux PHP version: 3.0.6 PHP Bug Type: Sybase (dblib) related Bug description: Crash in SQLServer Image Column Conversion php3_sybase_get_column_content in sybase.c (DB-Lib) crashes with buffer overflow when converting binary columns. The result of the IMAGE/VARBINARY to CHAR conversion is a hex string -> needs 2 bytes for each binary byte. The Patch below fixes this and also adds a bit more space for DATE conversions. Also works with MS-SQLServer. ---- cut ---- *** php-3.0.6/functions/sybase.c.orig Fri Sep 11 01:57:23 1998 --- php-3.0.6/functions/sybase.c Tue Dec 29 15:44:08 1998 *************** *** 637,639 **** char *res_buf; ! int res_length = dbdatlen(sybase_ptr->link,offset); register char *p; --- 637,640 ---- char *res_buf; ! int dat_length = dbdatlen(sybase_ptr->link,offset); ! int res_length = dat_length; register char *p; *************** *** 641,644 **** switch (coltype(offset)) { - case SYBBINARY: - case SYBVARBINARY: case SYBCHAR: --- 642,643 ---- *************** *** 646,648 **** --- 645,652 ---- case SYBTEXT: + break; + case SYBBINARY: + case SYBVARBINARY: case SYBIMAGE: + /* result is hex string */ + res_length = (dat_length * 2) + 4; break; *************** *** 650,652 **** /* take no chances, no telling how big the result would really be */ ! res_length += 20; break; --- 654,656 ---- /* take no chances, no telling how big the result would really be */ ! res_length += 40; break; *************** *** 655,657 **** res_buf = (char *) emalloc(res_length+1); ! dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset), res_length,SYBCHAR,res_buf,-1); --- 659,661 ---- res_buf = (char *) emalloc(res_length+1); ! res_length = dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset), dat_length,SYBCHAR,res_buf,-1); ---- cut ---- A Happy new year! Bernd -- PHP Development Mailing List http://www.php.net/ To unsubscribe send an empty message to php-dev-unsubscribe@lists.php.net For help: php-dev-help@lists.php.net