From a7885f2680f5a70358454c1fb02cada62b0ba532 Mon Sep 17 00:00:00 2001
From: James Woodcock <james_woodcock@yahoo.co.uk>
Date: Sat, 24 Oct 2020 13:27:34 +0100
Subject: [PATCH] Bounds check mdb_bind_column()

Return -1 to report out of bounds column number.
---
 include/mdbtools.h |  2 +-
 src/libmdb/data.c  | 27 +++++++++++++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/mdbtools.h b/include/mdbtools.h
index c3a79a9..7d4897c 100644
--- a/include/mdbtools.h
+++ b/include/mdbtools.h
@@ -509,7 +509,7 @@ void mdb_data_dump(MdbTableDef *table);
 void mdb_date_to_tm(double td, struct tm *t);
 void mdb_tm_to_date(struct tm *t, double *td);
 char *mdb_uuid_to_string(const void *buf, int start);
-void mdb_bind_column(MdbTableDef *table, int col_num, void *bind_ptr, int *len_ptr);
+int mdb_bind_column(MdbTableDef *table, int col_num, void *bind_ptr, int *len_ptr);
 int mdb_rewind_table(MdbTableDef *table);
 int mdb_fetch_row(MdbTableDef *table);
 int mdb_is_fixed_col(MdbColumn *col);
diff --git a/src/libmdb/data.c b/src/libmdb/data.c
index e463609..6add34e 100644
--- a/src/libmdb/data.c
+++ b/src/libmdb/data.c
@@ -73,20 +73,31 @@ void mdb_set_boolean_fmt_words(MdbHandle *mdb)
 	mdb->boolean_true_value  = boolean_true_word;
 }
 
-void mdb_bind_column(MdbTableDef *table, int col_num, void *bind_ptr, int *len_ptr)
+int mdb_bind_column(MdbTableDef *table, int col_num, void *bind_ptr, int *len_ptr)
 {
-	MdbColumn *col;
+	MdbColumn *col = NULL;
 
 	/* 
 	** the column arrary is 0 based, so decrement to get 1 based parameter 
 	*/
-	col=g_ptr_array_index(table->columns, col_num - 1);
-	
-	if (bind_ptr)
-		col->bind_ptr = bind_ptr;
-	if (len_ptr)
-		col->len_ptr = len_ptr;
+	col_num--;
+
+	if (col_num >= 0 && col_num < (int)table->num_cols) {
+		col=g_ptr_array_index(table->columns, col_num);
+
+		if (col) {
+			if (bind_ptr)
+				col->bind_ptr = bind_ptr;
+			if (len_ptr)
+				col->len_ptr = len_ptr;
+
+			return 0;
+		}
+	}
+
+	return -1;
 }
+
 int
 mdb_bind_column_by_name(MdbTableDef *table, gchar *col_name, void *bind_ptr, int *len_ptr)
 {