Commit 832d8e7
committed
Fix heap-buffer-overflow in ConvertingString<> state buffer allocation
On Linux, sizeof(wchar_t) = 4 bytes but sizeof(SQLWCHAR) = 2 bytes
(unixODBC defines SQLWCHAR as unsigned short). The ConvertingString
constructor used sizeof(wchar_t) to convert a byte-count argument
into the number of narrow characters needed:
lengthString = length / sizeof(wchar_t); // = 12/4 = 3 on Linux
For SQLGetDiagRecW the state buffer is declared as State(12, sqlState),
giving lengthString=3 and Alloc() allocating 3+2=5 bytes. strcpy()
then writes the 5-character SQL state plus its NUL terminator (6 bytes)
into that 5-byte buffer, producing a 1-byte heap-buffer-overflow caught
by AddressSanitizer.
The same latent bug exists in SQLErrorW (same State(12, sqlState) pattern).
Fix: divide by sizeof(SQLWCHAR) instead of sizeof(wchar_t).
sizeof(SQLWCHAR) == 2 on all platforms (Windows: SQLWCHAR=wchar_t=2;
Linux/unixODBC: SQLWCHAR=unsigned short=2), so the formula now yields:
lengthString = 12 / sizeof(SQLWCHAR) = 6
and Alloc() allocates 6+2=8 bytes, comfortably holding the SQL state.
On Windows sizeof(wchar_t)==sizeof(SQLWCHAR)==2, so this change is
a no-op there.
Found by: AddressSanitizer (introduced in CI via PR #288/#289)
Test: DataTypeTest.SmallintRoundTrip -> ExecIgnoreError -> SQLExecDirect
-> unixODBC dispatcher -> SQLGetDiagRecW -> sqlGetDiagRec(strcpy)1 parent 2e5af48 commit 832d8e7
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
85 | 85 | | |
86 | 86 | | |
87 | 87 | | |
88 | | - | |
| 88 | + | |
89 | 89 | | |
90 | 90 | | |
91 | 91 | | |
| |||
0 commit comments