|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2017-07-24 20:59 UTC] enekochan at gmail dot com
Description:
------------
Whe using dbase package in Mac OS X this error is raised when a record is written to disk, for example using dbase_replace_record.
Magick: abort due to signal 6 (SIGABRT) "Abort"...
Abort trap: 6
The problem (AFAIK) is due to a buffer overflow when copying the data to the disk in the put_dbf_field function in dbf_head.c file. If I change this in line 193 of dbf_head.c:
strlcpy(dbfield.dbf_name, dbf->db_fname, DBF_NAMELEN + 1);
To this:
strlcpy(dbfield.dbf_name, dbf->db_fname, DBF_NAMELEN);
Everything works fine.
I've tested this patch also in Ubuntu and CentOS and works fine even if the error does not happen there.
Test script:
---------------
<?php
// Increase by 1 the value of NFACCLI_A column for the first row in Claves table
$field = 'NFACCLI_A'; // Column name
$recordNumber = 1;
$value = 0;
$tablePath = realpath(sprintf('./%s.dbf', 'Claves')); // Set the table name
$resource = dbase_open($tablePath, 2);
$header = dbase_get_header_info($resource);
$record = dbase_get_record_with_names($resource, $recordNumber);
if (!is_null($record) && $record) {
if (array_key_exists($field, $record)) {
$value = $record[$field];
}
}
$record[$field] = $value + 1;
$result = dbase_replace_record($resource, array_values($record), $recordNumber);
dbase_close($resource);
Expected result:
----------------
No errors
Actual result:
--------------
A SIGABORT
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Tue Oct 28 22:00:01 2025 UTC |
I forgot to say that even 'make' gives a warning for that buffer overflow when compiling the module: /Users/enekochan/Downloads/dbase-7.0.0beta1/dbf_head.c:193:2: warning: '__builtin___strlcpy_chk' will always overflow destination buffer [-Wbuiltin-memcpy-chk-size] strlcpy(dbfield.dbf_name, dbf->db_fname, DBF_NAMELEN + 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /usr/include/secure/_string.h:105:3: note: expanded from macro 'strlcpy' __builtin___strlcpy_chk (dest, src, len, __darwin_obsz (dest)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated.