From 51b30586ea999744de6a15146257f2976825781e Mon Sep 17 00:00:00 2001 From: Aleksey Midenkov Date: Tue, 20 Sep 2016 15:41:38 +0000 Subject: [PATCH] FRM: fail to load extra2 option with size 1 fix From comment in unreg.h: Types of values in the MariaDB extra2 frm segment. Each value is written as type: 1 byte length: 1 byte (1..255) or \0 and 2 bytes. binary value of the 'length' bytes. length == 1 is valid. --- sql/table.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sql/table.cc b/sql/table.cc index 985ca800633..220112f93ed 100644 --- a/sql/table.cc +++ b/sql/table.cc @@ -1221,7 +1221,7 @@ int TABLE_SHARE::init_from_binary_frm_image(THD *thd, bool write, if (*extra2 != '/') // old frm had '/' there { const uchar *e2end= extra2 + len; - while (extra2 + 3 < e2end) + while (extra2 + 3 <= e2end) { uchar type= *extra2++; size_t length= *extra2++;