Bug #61586 sqlwcharchr might read one SQLWCHAR after end of string

• Submitted: 21 Jun 2011 12:19
• Modified: 25 Jan 2012 23:18
• Reporter: Jiri Dvorak
• Status: Closed
• Category: Connector / ODBC
• Severity: S2 (Serious)
• Version: 5.1.8
• OS: Any
• Assigned to: Bogdan Degtyariov
• CPU Architecture: Any

[21 Jun 2011 12:19] Jiri Dvorak

Description:
If the desired character is not found in the string, the final *wstr++ will move the wstr pointer behind the terminating zero so incorrect and possibly unallocated memory will be accessed by the following 'if' statement. 

How to repeat:
See description.

[22 Jun 2011 11:20] Bogdan Degtyariov

Jiri,

Probably you forgot to copy/paste the code fragment into your problem description because I do not see the if() statement you are talking about.

[22 Jun 2011 14:47] Jiri Dvorak

Sorry. My knowledge of the english language is limited. I was talking about 'if' statement "following in the function source code" and not "following in my description".

The code I am talking about is present in the mysql-connector-odbc-5.1.8 source code in the util/stringutil.c in function sqlwcharchr. That function (pasted bellow) contains only one if.

const SQLWCHAR *sqlwcharchr(const SQLWCHAR *wstr, SQLWCHAR wchr)
{
  while (*wstr != wchr && *wstr++);
  if (*wstr == wchr)
    return wstr;
  else
    return NULL;
}

[3 Aug 2011 12:50] Bogdan Degtyariov

Verified, the problem exists.

[3 Aug 2011 12:54] Bogdan Degtyariov

=== modified file 'util/stringutil.c'
--- util/stringutil.c	2010-08-19 15:37:55 +0000
+++ util/stringutil.c	2011-08-03 12:53:02 +0000
@@ -526,11 +526,15 @@
  */
 const SQLWCHAR *sqlwcharchr(const SQLWCHAR *wstr, SQLWCHAR wchr)
 {
-  while (*wstr != wchr && *wstr++);
-  if (*wstr == wchr)
-    return wstr;
-  else
-    return NULL;
+  while (*wstr)
+  {
+    if (*wstr == wchr)
+    {
+      return wstr;
+    }
+    ++wstr;
+  }
+  return NULL;
 }

[3 Aug 2011 12:57] Bogdan Degtyariov

An the entry for CHANGELOG:

=== modified file 'ChangeLog'
--- ChangeLog	2011-02-04 20:03:09 +0000
+++ ChangeLog	2011-08-03 12:56:44 +0000
@@ -3,7 +3,7 @@
   Bugs fixed:
   * SQLFetch() did not return SQL_ERROR if connection was dropped due to a
     timeout. (Bug #39878)
-
+  * sqlwcharchr might read one SQLWCHAR after end of string. (Bug #61586)
 ----
 
 5.1.8 (08-Nov-2010)

[3 Aug 2011 13:04] Lawrenty Novitsky

pushed to the trunk as rev#979

[25 Jan 2012 23:18] Philip Olson

This was already documented, as:

An off-by-one error, where <literal>sqlwcharchr</literal> might
read one <literal>SQLWCHAR</literal> after the end of a string.

So, closing.