AV in isc_start_transaction (isc_start_multiple) - bad TEB [CORE1756]

[firebird-automations]

Submitted by: @ibprovider

AV samples

isc_start_transaction(status_vector, &valid_tr_handle, 1, &valid_db_handle, 32000 , NULL)

isc_start_transaction(status_vector, &valid_tr_handle, 1, &valid_db_handle, -1 , NULL)

isc_start_transaction(status_vector, &valid_tr_handle, 1, &valid_db_handle, -1 , valid_pointer_to_tpb)

I think, need write code like

if(tpb_length<0)
{
// ERROR
}

if(tpb_length!=0 && tpb==NULL)
{
// ERROR
}

Commits: 48e9858

[firebird-automations]

Commented by: @ibprovider

why.cpp ------------

ISC_STATUS API_ROUTINE GDS_START_MULTIPLE( ... )
{
// ....

for (....)
{
if(vector->teb_tpb_length<0)
{
Firebird::status_exception::raise(isc_bad_tpb_form,isc_arg_end);
}

if(vector->teb_tpb==NULL && vector->teb_tpb_length>0)
{
Firebird::status_exception::raise(isc_bad_tpb_form,isc_arg_end);
}

// ....
}//for

// ....
}// GDS_START_MULTIPLE

-----
Additional proposal: change the type of TEB::teb_tpb to const UCHAR*

Thanks

[firebird-automations]

Commented by: @ibprovider

Also:

if(vector==NULL)
{
Firebird::status_exception::raise(isc_bad_trans_handle,/* Do we need new error code here ? */ isc_arg_end);
}

[firebird-automations]

Modified by: @AlexPeshkoff

assignee: Alexander Peshkov [ alexpeshkoff ]

[firebird-automations]

Commented by: @AlexPeshkoff

Appropriate tests are added.
Cause none of AVs can be used for remote attack, no use backporting.

[firebird-automations]

Modified by: @AlexPeshkoff

status: Open [ 1 ] => Resolved [ 5 ]

resolution: Fixed [ 1 ]

Fix Version: 2.5 Alpha 1 [ 10224 ]

[firebird-automations]

Modified by: @pcisar

status: Resolved [ 5 ] => Closed [ 6 ]

[firebird-automations]

Modified by: @pavel-zotov

QA Status: No test