Subject: [postgresql-interfaces/psqlodbc] issue #119: Security: Potential integer overflow in bindcol_localize_exec()

From: "kkevin-cloud (@kkevin-cloud)" <[email-masked]>
Date: Tue, 27 May 2025 13:53:34 +0000

## Security Issue

A potential integer overflow vulnerability has been identified in the `bindcol_localize_exec()` function in `win_unicode.c`.

### Problem Description
The function `bindcol_localize_exec()` takes a `size_t n` parameter and passes it to `wstrtomsg()` which expects an `int` parameter. This implicit conversion from `size_t` (unsigned) to `int` (signed) can cause integer overflow when `n > INT_MAX`.

### Location
File: win_unicode.c
Function: `bindcol_localize_exec()`
Line: `l = wstrtomsg(wcsalc, ldt, n);`

### Impact
- Buffer size miscalculation due to integer overflow
- Potential buffer overflow
- Possible security vulnerability (CWE-190: Integer Overflow or Wraparound)

### Suggested Fix
Add a size check before the conversion:

```c
SQLLEN bindcol_localize_exec(char *ldt, size_t n, BOOL lf_conv, char **wcsbuf)
{
    SQLLEN l = (-2);
    
    if (n > INT_MAX) {
        // Handle error case
        return -1;
    }
    
    if (use_wcs)
    {
        wchar_t *wcsalc = (wchar_t *) *wcsbuf;
        l = wstrtomsg(wcsalc, ldt, (int)n);
    }
    // ...
}
```

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Tue, 27 May 2025 15:15:53 +0000

closed via PR #121