mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-05-15 03:17:20 +02:00
Code Issues Projects Releases Packages Wiki Activity

Bug#49134 5.1 server segfaults with 2byte collation file

Browse source 
Problem: add_collation did not check that cs->number is smaller
than the number of elements in the array all_charsets[],
so server could crash when loading an Index.xml file with
a collation ID greater the number of elements 
(for example when downgrading from 5.5).

Fix: adding a condition to check that cs->number is not out of valid range.
This commit is contained in:
Alexander Barkov 2009-12-15 13:48:29 +04:00
commit cff23162ec
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
mysys/charset.c
View file

@ -220,7 +220,8 @@ copy_uca_collation(CHARSET_INFO *to, CHARSET_INFO *from)
static int add_collation(CHARSET_INFO *cs)
{
if (cs->name && (cs->number ||
(cs->number=get_collation_number_internal(cs->name))))
(cs->number=get_collation_number_internal(cs->name))) &&
cs->number < array_elements(all_charsets))
{
if (!all_charsets[cs->number])
{