mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-02-01 11:31:51 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed bug#16752 Binary table files created in mysqld v4.1 caused buffer overrun

Browse source 
and possibly server crash in mysqld v5.0.

Reported MyISAM table was created in mysqld 4.1 and contains varchar field.
When binary files of that table was moved to 5.0, mysqld treats that varchar 
field as a string field. 
In order to make grouping server calculates group buffer, and because
that field is string server assumes it has fixed length and doesn't add
space for length, but later that field is converted to varchar field. 
Due to this, when field values were actually copied, additional space for
length bytes is taken and buffer overrun occurs, which may lead to server crash.

The calc_group_buffer() function now reserves additional space for length
bytes for VAR_STRING fields, like for VARCHAR fields.


sql/sql_select.cc:
  Fixed bug#16752 Binary table files created in mysqld v4.1 caused buffer overrun and possibly server crash in mysqld v5.0.
  The calc_group_buffer() function now reserves additional space for length
  bytes for VAR_STRING fields, like for VARCHAR fields.
This commit is contained in:
unknown 2006-02-08 15:12:48 +03:00
parent 86733db80b
commit 4e9b14879b
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
sql/sql_select.cc
View file

@ -12717,11 +12717,12 @@ calc_group_buffer(JOIN *join,ORDER *group)
Field *field= group_item->get_tmp_table_field();
if (field)
{
if (field->type() == FIELD_TYPE_BLOB)
enum_field_types type;
if ((type= field->type()) == FIELD_TYPE_BLOB)
key_length+=MAX_BLOB_WIDTH; // Can't be used as a key
else if (field->type() == MYSQL_TYPE_VARCHAR)
else if (type == MYSQL_TYPE_VARCHAR || type == MYSQL_TYPE_VAR_STRING)
key_length+= field->field_length + HA_KEY_BLOB_LENGTH;
else if (field->type() == FIELD_TYPE_BIT)
else if (type == FIELD_TYPE_BIT)
{
/* Bit is usually stored as a longlong key for group fields */
key_length+= 8; // Big enough