Skip to content

Buffer overflow when padding line with national characters causes ISQL crash #6796

@dmitry-starodubov

Description

@dmitry-starodubov

I have a client application with national characters in its name.
For example, I just renamed isql.exe to "Это какое-то клиентское приложение, содержащее национальные символы.exe"
If such an application is connected to the server, ISQL (from Firebird v3) crashes when executing such a query:
select mon$remote_process from mon$attachments;
It's because of buffer overflow in process_statement.
Here

	// Calculate display width and add a few for line termination, et al
	const SLONG linelength = process_message_display(message, pad) + 10;

	// Allocate the print line, the header line and the separator

	TEXT* line = (TEXT*) ISQL_ALLOC(linelength);

linelength is determined as 266 and we have a buffer "line" of the same size.
Later in IcuUtil::pad ISQL tries to pad the line to width 255, but in fact it writes 314 bytes in this buffer. Seems, it doesn't take into account multibyte characters.
If connection charset is specified, it works fine.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions