Poco:Data:ODBC:Binder.h causes a crash #512
Description
In bindImplVec template function.
if (_vecLengthIndicator.size() <= pos)
{
_vecLengthIndicator.resize(pos + 1);
_vecLengthIndicator[pos].resize(length, sizeof(T));
}
if (Utility::isError(SQLBindParameter(_rStmt,
(SQLUSMALLINT) pos + 1,
toODBCDirection(dir),
cDataType,
Utility::sqlDataType(cDataType),
colSize,
decDigits,
(SQLPOINTER) &val[0],
0,
&_vecLengthIndicator[pos][0])))
{
throw StatementException(_rStmt, "SQLBindParameter()");
}
_vecLengthIndicator[pos].resize(length, sizeof(T)) might change the address of _vecLengthIndicator[pos-1][0].
But Poco passes the address of _vecLengthIndicator[pos][0] to SQLBindParameter function.
When pos=1 and the address of _vecLengthIndicator[0][0] is invalid after _vecLengthIndicator[pos].resize(length, sizeof(T)) executed.
In valgrind, you can see the Invalid read of size error messages and cause a segmentation fault.