MDEV-5615 crash in Gcalc_function::add_operation.

The result is EMPTY for a buffer(line, -1), but we still
need one FALSE operation to be stored in the condition.
And we actually add it but forgot to alloc memory to store it.
This commit is contained in:
Alexey Botchkov 2014-02-18 17:15:25 +04:00
commit 820b1a6687
4 changed files with 12 additions and 3 deletions

View file

@ -452,3 +452,6 @@ ST_NUMPOINTS(ST_EXTERIORRING(ST_BUFFER( POLYGONFROMTEXT( 'POLYGON( ( 0.0 -3.0,
0.0 -3.0
))' ),
136
select astext(buffer(st_linestringfromwkb(linestring(point(-1,1), point(-1,-2))),-1));
astext(buffer(st_linestringfromwkb(linestring(point(-1,1), point(-1,-2))),-1))
GEOMETRYCOLLECTION EMPTY

View file

@ -325,3 +325,6 @@ SELECT ST_NUMPOINTS(ST_EXTERIORRING(ST_BUFFER( POLYGONFROMTEXT( 'POLYGON( ( 0.0
0.0 -3.0
))' ), 3 )));
# MDEV-5615 crash in Gcalc_function::add_operation
select astext(buffer(st_linestringfromwkb(linestring(point(-1,1), point(-1,-2))),-1));

View file

@ -857,7 +857,7 @@ String *Item_func_spatial_operation::val_str(String *str_value)
str_value->length(0);
str_value->q_append(srid);
if (!Geometry::create_from_opresult(&buffer1, str_value, res_receiver))
if (Geometry::create_from_opresult(&buffer1, str_value, res_receiver))
goto exit;
exit:
@ -1114,6 +1114,8 @@ int Item_func_buffer::Transporter::start_line()
{
if (buffer_op == Gcalc_function::op_difference)
{
if (m_fn->reserve_op_buffer(1))
return 1;
m_fn->add_operation(Gcalc_function::op_false, 0);
skip_line= TRUE;
return 0;
@ -1315,7 +1317,7 @@ String *Item_func_buffer::val_str(String *str_value)
str_value->length(0);
str_value->q_append(srid);
if (!Geometry::create_from_opresult(&buffer, str_value, res_receiver))
if (Geometry::create_from_opresult(&buffer, str_value, res_receiver))
goto mem_error;
null_value= 0;

View file

@ -298,7 +298,8 @@ int Geometry::create_from_opresult(Geometry_buffer *g_buf,
res->q_append((char) wkb_ndr);
res->q_append(geom_type);
return obj->init_from_opresult(res, rr.result(), rr.length());
return obj->init_from_opresult(res, rr.result(), rr.length()) == 0 &&
rr.length();
}