mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-15 19:42:28 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-31881 ASAN: unknown-crash in check_ulonglong (sql/sql_analyse.cc) on SELECT ... FROM ... PROCEDURE ANALYSE()

Browse source 
Fixing a wrong condition which made the code read 1 byte behind the buffer.
This commit is contained in:
Alexander Barkov 2024-11-21 10:01:48 +04:00
parent 39f1f30f68
commit 95df7ea33a
3 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
mysql-test/main/func_analyse.result
View file

@ -245,5 +245,15 @@ Field_name Min_value Max_value Min_length Max_length Empties_or_zeros Nulls Avg_
test.t1.c 1.1 1.3 3 3 0 0 3.0000 NULL ENUM('1.1','1.3') NOT NULL
DROP TABLE t1;
#
# MDEV-31881 ASAN: unknown-crash in check_ulonglong (sql/sql_analyse.cc) on SELECT ... FROM ... PROCEDURE ANALYSE()
#
CREATE TABLE t (a INT, b CHAR(10));
INSERT INTO t VALUES (0,'0000000000');
SELECT * FROM t PROCEDURE ANALYSE();
Field_name Min_value Max_value Min_length Max_length Empties_or_zeros Nulls Avg_value_or_avg_length Std Optimal_fieldtype
test.t.a 0 0 1 1 1 0 0.0000 0.0000 ENUM('0') NOT NULL
test.t.b 0000000000 0000000000 10 10 0 0 10.0000 NULL ENUM('0000000000') NOT NULL
DROP TABLE t;
#
# End of 10.5 tests
#

9
mysql-test/main/func_analyse.test
View file

@ -255,6 +255,15 @@ INSERT INTO t1 VALUES (1.3),(1.1);
SELECT * FROM t1 PROCEDURE ANALYSE();
DROP TABLE t1;
--echo #
--echo # MDEV-31881 ASAN: unknown-crash in check_ulonglong (sql/sql_analyse.cc) on SELECT ... FROM ... PROCEDURE ANALYSE()
--echo #
CREATE TABLE t (a INT, b CHAR(10));
INSERT INTO t VALUES (0,'0000000000');
SELECT * FROM t PROCEDURE ANALYSE();
DROP TABLE t;
--echo #
--echo # End of 10.5 tests
--echo #

2
sql/sql_analyse.cc
View file

@ -1204,7 +1204,7 @@ uint check_ulonglong(const char *str, uint length)
const char *long_str = "2147483647", *ulonglong_str = "18446744073709551615";
const uint long_len = 10, ulonglong_len = 20;
while (*str == '0' && length)
while (length && *str == '0')
{
str++; length--;
}