[PHP-DEV] Bug #1012: Crash in SQLServer Image Column Conversion From: bro <email protected>
Date: 12/29/98

From: bro <email protected>
Operating system: Linux
PHP version: 3.0.6
PHP Bug Type: Sybase (dblib) related
Bug description: Crash in SQLServer Image Column Conversion

php3_sybase_get_column_content in sybase.c (DB-Lib)
crashes with buffer overflow when converting binary columns.
The result of the IMAGE/VARBINARY to CHAR conversion is a
hex string -> needs 2 bytes for each binary byte.

The Patch below fixes this and also adds a bit more space
for DATE conversions. Also works with MS-SQLServer.

---- cut ----
*** php-3.0.6/functions/sybase.c.orig Fri Sep 11 01:57:23 1998
--- php-3.0.6/functions/sybase.c Tue Dec 29 15:44:08 1998
***************
*** 637,639 ****
                                  char *res_buf;
! int res_length = dbdatlen(sybase_ptr->link,offset);
                                  register char *p;
--- 637,640 ----
                                  char *res_buf;
! int dat_length = dbdatlen(sybase_ptr->link,offset);
! int res_length = dat_length;
                                  register char *p;
***************
*** 641,644 ****
                                  switch (coltype(offset)) {
- case SYBBINARY:
- case SYBVARBINARY:
                                          case SYBCHAR:
--- 642,643 ----
***************
*** 646,648 ****
--- 645,652 ----
                                          case SYBTEXT:
+ break;
+ case SYBBINARY:
+ case SYBVARBINARY:
                                          case SYBIMAGE:
+ /* result is hex string */
+ res_length = (dat_length * 2) + 4;
                                                  break;
***************
*** 650,652 ****
                                                  /* take no chances, no telling how big the result would really be */
! res_length += 20;
                                                  break;
--- 654,656 ----
                                                  /* take no chances, no telling how big the result would really be */
! res_length += 40;
                                                  break;
***************
*** 655,657 ****
                                  res_buf = (char *) emalloc(res_length+1);
! dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset), res_length,SYBCHAR,res_buf,-1);
                  
--- 659,661 ----
                                  res_buf = (char *) emalloc(res_length+1);
! res_length = dbconvert(NULL,coltype(offset),dbdata(sybase_ptr->link,offset), dat_length,SYBCHAR,res_buf,-1);
                  

---- cut ----

A Happy new year!

Bernd 

--
PHP Development Mailing List   http://www.php.net/
To unsubscribe send an empty message to php-dev-unsubscribe <email protected>
For help: php-dev-help <email protected>