mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 03:52:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes mysqld

Browse source 
Server may crash if sanity checks of COLUMN_GET() fail.

COLUMN_GET() description generator expects parent CAST item, which may not have
been created due to failure of sanity checks. Then further attempt to report
an error may crash the server.

Fixed COLUMN_GET() description generator to handle such case.
This commit is contained in:
Sergey Vojtovich 2015-06-04 16:04:05 +04:00
parent b611ac06a7
commit a2bb9d2639
3 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
mysql-test/r/dyncol.result
View file

@ -1444,3 +1444,9 @@ column_get(column_create(1, "18446744073709552001" as char), 1 as int)
Warnings:
Warning 1918 Encountered illegal value '18446744073709552001' when converting to INT
Note 1105 Cast to signed converted positive out-of-range integer to it's negative complement
#
# MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes
# mysqld
#
SELECT COLUMN_GET(`x`, 'y' AS DECIMAL(5,34));
ERROR 42000: Too big scale 34 specified for ''y''. Maximum is 30.

6
mysql-test/t/dyncol.test
View file

@ -643,3 +643,9 @@ SELECT
#
select column_get(column_create(1, "18446744073709552001" as char), 1 as int);
--echo #
--echo # MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes
--echo # mysqld
--echo #
--error ER_TOO_BIG_SCALE
SELECT COLUMN_GET(`x`, 'y' AS DECIMAL(5,34));

10
sql/item_strfunc.cc
View file

@ -4467,6 +4467,16 @@ null:
void Item_dyncol_get::print(String *str, enum_query_type query_type)
{
/*
Parent cast doesn't exist yet, only print dynamic column name. This happens
when called from create_func_cast() / wrong_precision_error().
*/
if (!str->length())
{
args[1]->print(str, query_type);
return;
}
/* see create_func_dyncol_get */
DBUG_ASSERT(str->length() >= 5);
DBUG_ASSERT(strncmp(str->ptr() + str->length() - 5, "cast(", 5) == 0);