Home Original page

FIX: Memory Leak and Security Risk with Static Token Buffer by gargsaumya · Pull Request #264 · microsoft/mssql-python

📊 Code Coverage Report

🔥 Diff Coverage

0%

🎯 Overall Coverage

74%

📈 Total Lines Covered: 4144 out of 5563
📁 Project: mssql-python

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

  • mssql_python/pybind/connection/connection.cpp (0.0%): Missing lines 176,183-185,200-202

Summary

  • Total: 7 lines
  • Missing: 7 lines
  • Coverage: 0%

mssql_python/pybind/connection/connection.cpp

Lines 172-180

  172 SQLRETURN Connection::setAttribute(SQLINTEGER attribute, py::object value) {
  173     LOG("Setting SQL attribute");
  174     SQLPOINTER ptr = nullptr;
  175     SQLINTEGER length = 0;
! 176     std::string buffer; // to hold sensitive data temporarily
  177 
  178     if (py::isinstance<py::int_>(value)) {
  179         int intValue = value.cast<int>();
  180         ptr = reinterpret_cast<SQLPOINTER>(static_cast<uintptr_t>(intValue));

Lines 179-189

  179         int intValue = value.cast<int>();
  180         ptr = reinterpret_cast<SQLPOINTER>(static_cast<uintptr_t>(intValue));
  181         length = SQL_IS_INTEGER;
  182     } else if (py::isinstance<py::bytes>(value) || py::isinstance<py::bytearray>(value)) {
! 183         buffer = value.cast<std::string>();  // stack buffer
! 184         ptr = buffer.data();
! 185         length = static_cast<SQLINTEGER>(buffer.size());
  186     } else {
  187         LOG("Unsupported attribute value type");
  188         return SQL_ERROR;
  189     }

Lines 196-206

  196         LOG("Set attribute successfully");
  197     }
  198     
  199     // Zero out sensitive data if used
! 200     if (!buffer.empty()) {
! 201         std::fill(buffer.begin(), buffer.end(), static_cast<char>(0));
! 202     }
  203     return ret;
  204 }
  205 
  206 void Connection::applyAttrsBefore(const py::dict& attrs) {

📋 Files Needing Attention

📉 Files with overall lowest coverage (click to expand) 
mssql_python.pybind.connection.connection.cpp: 67.6%
mssql_python.ddbc_bindings.py: 68.5%
mssql_python.pybind.ddbc_bindings.cpp: 69.4%
mssql_python.pybind.connection.connection_pool.cpp: 78.9%
mssql_python.cursor.py: 79.3%
mssql_python.connection.py: 81.7%
mssql_python.helpers.py: 84.7%
mssql_python.auth.py: 85.3%
mssql_python.type.py: 86.8%
mssql_python.pooling.py: 88.8%

🔗 Quick Links