mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 12:02:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Bug #29494 Field packet with NULL fields crashes libmysqlclient.

Browse source 
unpack_fields() didn't expect NULL_LENGHT in the field's descriptions.
In this case we get NULL in the resulting string so cannot use
strdup_root to make a copy of it.
strdup_root changed with strmake_root as it's NULL-safe


sql-common/client.c:
  Bug #29494 Field packet with NULL fields crashes libmysqlclient
  
  strdup_root changed with strmake_root in unpack_fields()
This commit is contained in:
unknown 2007-07-20 16:05:55 +05:00
parent c20595d8a0
commit 1a2d2117ff
1 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
sql-common/client.c
View file

@ -1176,12 +1176,12 @@ unpack_fields(MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
/* fields count may be wrong */
DBUG_ASSERT ((field - result) < fields);
cli_fetch_lengths(&lengths[0], row->data, default_value ? 8 : 7);
field->catalog = strdup_root(alloc,(char*) row->data[0]);
field->db = strdup_root(alloc,(char*) row->data[1]);
field->table = strdup_root(alloc,(char*) row->data[2]);
field->org_table= strdup_root(alloc,(char*) row->data[3]);
field->name = strdup_root(alloc,(char*) row->data[4]);
field->org_name = strdup_root(alloc,(char*) row->data[5]);
field->catalog= strmake_root(alloc,(char*) row->data[0], lengths[0]);
field->db= strmake_root(alloc,(char*) row->data[1], lengths[1]);
field->table= strmake_root(alloc,(char*) row->data[2], lengths[2]);
field->org_table= strmake_root(alloc,(char*) row->data[3], lengths[3]);
field->name= strmake_root(alloc,(char*) row->data[4], lengths[4]);
field->org_name= strmake_root(alloc,(char*) row->data[5], lengths[5]);
field->catalog_length= lengths[0];
field->db_length= lengths[1];
@ -1202,7 +1202,7 @@ unpack_fields(MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
field->flags|= NUM_FLAG;
if (default_value && row->data[7])
{
field->def=strdup_root(alloc,(char*) row->data[7]);
field->def=strmake_root(alloc,(char*) row->data[7], lengths[7]);
field->def_length= lengths[7];
}
else