From a7a6c6eb08f9713027a06473c96a4c6ed1494398 Mon Sep 17 00:00:00 2001 From: "holyfoot/hf@mysql.com/hfmain.(none)" <> Date: Wed, 3 Oct 2007 13:35:35 +0500 Subject: [PATCH 1/2] Bug #30955 geomfromtext() crasher. end-of-line check missed in Gis_read_stream::get_next_word, what can lead to crashes (expecially with NULL strings). End-of-line check added --- mysql-test/r/gis.result | 6 ++++++ mysql-test/t/gis.test | 8 ++++++++ sql/gstream.cc | 2 +- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/mysql-test/r/gis.result b/mysql-test/r/gis.result index 643a3d6b434..55f70e59fcf 100644 --- a/mysql-test/r/gis.result +++ b/mysql-test/r/gis.result @@ -724,4 +724,10 @@ SELECT * FROM t1; a NULL DROP TABLE t1; +CREATE TABLE `t1` ( `col9` set('a'), `col89` date); +INSERT INTO `t1` VALUES ('','0000-00-00'); +select geomfromtext(col9,col89) as a from t1; +a +NULL +DROP TABLE t1; End of 4.1 tests diff --git a/mysql-test/t/gis.test b/mysql-test/t/gis.test index 7182e040d46..cf5c3b31bc1 100644 --- a/mysql-test/t/gis.test +++ b/mysql-test/t/gis.test @@ -419,4 +419,12 @@ INSERT INTO t1 VALUES (NULL); SELECT * FROM t1; DROP TABLE t1; +# +# Bug #30955 geomfromtext() crasher +# +CREATE TABLE `t1` ( `col9` set('a'), `col89` date); +INSERT INTO `t1` VALUES ('','0000-00-00'); +select geomfromtext(col9,col89) as a from t1; +DROP TABLE t1; + --echo End of 4.1 tests diff --git a/sql/gstream.cc b/sql/gstream.cc index f7d11d76b0c..f986d9dc7f3 100644 --- a/sql/gstream.cc +++ b/sql/gstream.cc @@ -45,7 +45,7 @@ bool Gis_read_stream::get_next_word(LEX_STRING *res) skip_space(); res->str= (char*) m_cur; /* The following will also test for \0 */ - if (!my_isvar_start(&my_charset_bin, *m_cur)) + if ((m_cur >= m_limit) || !my_isvar_start(&my_charset_bin, *m_cur)) return 1; /* From 54b0cf97b382a0cd9f5e6bd635b9bdd049d91e12 Mon Sep 17 00:00:00 2001 From: "holyfoot/hf@mysql.com/hfmain.(none)" <> Date: Fri, 5 Oct 2007 15:40:32 +0500 Subject: [PATCH 2/2] Bug #30286 spatial index cause corruption and server crash! As the result of DOUBLE claculations can be bigger than DBL_MAX constant we use in code, we shouldn't use this constatn as a biggest possible value. Particularly the rtree_pick_key function set 'min_area= DBL_MAX' relying that any rtree_area_increase result will be less so we return valid key. Though in rtree_area_increase function we calculate the area of the rectangle, so the result can be 'inf' if the rectangle is huge enough, which is bigger than DBL_MAX. Code of the rtree_pick_key modified so we always return a valid key. --- myisam/rt_index.c | 18 +++++------------- myisam/rt_mbr.c | 5 ++++- mysql-test/r/gis-rtree.result | 31 ++++++++++++++++++++++++++++++ mysql-test/t/gis-rtree.test | 36 +++++++++++++++++++++++++++++++++++ 4 files changed, 76 insertions(+), 14 deletions(-) diff --git a/myisam/rt_index.c b/myisam/rt_index.c index 238432006a4..f19ecacef63 100644 --- a/myisam/rt_index.c +++ b/myisam/rt_index.c @@ -485,15 +485,16 @@ static uchar *rtree_pick_key(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *key, uint key_length, uchar *page_buf, uint nod_flag) { double increase; - double best_incr = DBL_MAX; + double best_incr; double area; double best_area; - uchar *best_key; + uchar *best_key= NULL; uchar *k = rt_PAGE_FIRST_KEY(page_buf, nod_flag); uchar *last = rt_PAGE_END(page_buf); LINT_INIT(best_area); LINT_INIT(best_key); + LINT_INIT(best_incr); for (; k < last; k = rt_PAGE_NEXT_KEY(k, key_length, nod_flag)) { @@ -502,22 +503,13 @@ static uchar *rtree_pick_key(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *key, &area)) == -1.0) return NULL; /* The following should be safe, even if we compare doubles */ - if (increase < best_incr) + if (!best_key || increase < best_incr || + ((increase == best_incr) && (area < best_area))) { best_key = k; best_area = area; best_incr = increase; } - else - { - /* The following should be safe, even if we compare doubles */ - if ((increase == best_incr) && (area < best_area)) - { - best_key = k; - best_area = area; - best_incr = increase; - } - } } return best_key; } diff --git a/myisam/rt_mbr.c b/myisam/rt_mbr.c index 897862c1c9a..31eaac0ae70 100644 --- a/myisam/rt_mbr.c +++ b/myisam/rt_mbr.c @@ -525,7 +525,10 @@ double rtree_overlapping_area(HA_KEYSEG *keyseg, uchar* a, uchar* b, } /* -Calculates MBR_AREA(a+b) - MBR_AREA(a) + Calculates MBR_AREA(a+b) - MBR_AREA(a) + Note: when 'a' and 'b' objects are far from each other, + the area increase can be really big, so this function + can return 'inf' as a result. */ double rtree_area_increase(HA_KEYSEG *keyseg, uchar* a, uchar* b, uint key_length, double *ab_area) diff --git a/mysql-test/r/gis-rtree.result b/mysql-test/r/gis-rtree.result index 762dda4e501..3df316acd77 100644 --- a/mysql-test/r/gis-rtree.result +++ b/mysql-test/r/gis-rtree.result @@ -1420,3 +1420,34 @@ CHECK TABLE t1 EXTENDED; Table Op Msg_type Msg_text test.t1 check status OK DROP TABLE t1; +create table t1 (a geometry not null, spatial index(a)); +insert into t1 values (PointFromWKB(POINT(1.1517219314031e+164, 131072))); +insert into t1 values (PointFromWKB(POINT(9.1248812352444e+192, 2.9740338169556e+284))); +insert into t1 values (PointFromWKB(POINT(4.7783097267365e-299, -0))); +insert into t1 values (PointFromWKB(POINT(1.49166814624e-154, 2.0880974297595e-53))); +insert into t1 values (PointFromWKB(POINT(4.0917382598702e+149, 1.2024538023802e+111))); +insert into t1 values (PointFromWKB(POINT(2.0349165139404e+236, 2.9993936277913e-241))); +insert into t1 values (PointFromWKB(POINT(2.5243548967072e-29, 1.2024538023802e+111))); +insert into t1 values (PointFromWKB(POINT(0, 6.9835074892995e-251))); +insert into t1 values (PointFromWKB(POINT(2.0880974297595e-53, 3.1050361846014e+231))); +insert into t1 values (PointFromWKB(POINT(2.8728483499323e-188, 2.4600631144627e+260))); +insert into t1 values (PointFromWKB(POINT(3.0517578125e-05, 2.0349165139404e+236))); +insert into t1 values (PointFromWKB(POINT(1.1517219314031e+164, 1.1818212630766e-125))); +insert into t1 values (PointFromWKB(POINT(2.481040258324e-265, 5.7766220027675e-275))); +insert into t1 values (PointFromWKB(POINT(2.0880974297595e-53, 2.5243548967072e-29))); +insert into t1 values (PointFromWKB(POINT(5.7766220027675e-275, 9.9464647281957e+86))); +insert into t1 values (PointFromWKB(POINT(2.2181357552967e+130, 3.7857669957337e-270))); +insert into t1 values (PointFromWKB(POINT(4.5767114681874e-246, 3.6893488147419e+19))); +insert into t1 values (PointFromWKB(POINT(4.5767114681874e-246, 3.7537584144024e+255))); +insert into t1 values (PointFromWKB(POINT(3.7857669957337e-270, 1.8033161362863e-130))); +insert into t1 values (PointFromWKB(POINT(0, 5.8774717541114e-39))); +insert into t1 values (PointFromWKB(POINT(1.1517219314031e+164, 2.2761049594727e-159))); +insert into t1 values (PointFromWKB(POINT(6.243497100632e+144, 3.7857669957337e-270))); +insert into t1 values (PointFromWKB(POINT(3.7857669957337e-270, 2.6355494858076e-82))); +insert into t1 values (PointFromWKB(POINT(2.0349165139404e+236, 3.8518598887745e-34))); +insert into t1 values (PointFromWKB(POINT(4.6566128730774e-10, 2.0880974297595e-53))); +insert into t1 values (PointFromWKB(POINT(2.0880974297595e-53, 1.8827498946116e-183))); +insert into t1 values (PointFromWKB(POINT(1.8033161362863e-130, 9.1248812352444e+192))); +insert into t1 values (PointFromWKB(POINT(4.7783097267365e-299, 2.2761049594727e-159))); +insert into t1 values (PointFromWKB(POINT(1.94906280228e+289, 1.2338789709327e-178))); +drop table t1; diff --git a/mysql-test/t/gis-rtree.test b/mysql-test/t/gis-rtree.test index f28a718cc11..b7d0f797e37 100644 --- a/mysql-test/t/gis-rtree.test +++ b/mysql-test/t/gis-rtree.test @@ -798,4 +798,40 @@ UPDATE t1 set spatial_point=GeomFromText('POINT(41 46)') where c1 like 'f%'; CHECK TABLE t1 EXTENDED; DROP TABLE t1; +# +# Bug #30286 spatial index cause corruption and server crash! +# + +create table t1 (a geometry not null, spatial index(a)); +insert into t1 values (PointFromWKB(POINT(1.1517219314031e+164, 131072))); +insert into t1 values (PointFromWKB(POINT(9.1248812352444e+192, 2.9740338169556e+284))); +insert into t1 values (PointFromWKB(POINT(4.7783097267365e-299, -0))); +insert into t1 values (PointFromWKB(POINT(1.49166814624e-154, 2.0880974297595e-53))); +insert into t1 values (PointFromWKB(POINT(4.0917382598702e+149, 1.2024538023802e+111))); +insert into t1 values (PointFromWKB(POINT(2.0349165139404e+236, 2.9993936277913e-241))); +insert into t1 values (PointFromWKB(POINT(2.5243548967072e-29, 1.2024538023802e+111))); +insert into t1 values (PointFromWKB(POINT(0, 6.9835074892995e-251))); +insert into t1 values (PointFromWKB(POINT(2.0880974297595e-53, 3.1050361846014e+231))); +insert into t1 values (PointFromWKB(POINT(2.8728483499323e-188, 2.4600631144627e+260))); +insert into t1 values (PointFromWKB(POINT(3.0517578125e-05, 2.0349165139404e+236))); +insert into t1 values (PointFromWKB(POINT(1.1517219314031e+164, 1.1818212630766e-125))); +insert into t1 values (PointFromWKB(POINT(2.481040258324e-265, 5.7766220027675e-275))); +insert into t1 values (PointFromWKB(POINT(2.0880974297595e-53, 2.5243548967072e-29))); +insert into t1 values (PointFromWKB(POINT(5.7766220027675e-275, 9.9464647281957e+86))); +insert into t1 values (PointFromWKB(POINT(2.2181357552967e+130, 3.7857669957337e-270))); +insert into t1 values (PointFromWKB(POINT(4.5767114681874e-246, 3.6893488147419e+19))); +insert into t1 values (PointFromWKB(POINT(4.5767114681874e-246, 3.7537584144024e+255))); +insert into t1 values (PointFromWKB(POINT(3.7857669957337e-270, 1.8033161362863e-130))); +insert into t1 values (PointFromWKB(POINT(0, 5.8774717541114e-39))); +insert into t1 values (PointFromWKB(POINT(1.1517219314031e+164, 2.2761049594727e-159))); +insert into t1 values (PointFromWKB(POINT(6.243497100632e+144, 3.7857669957337e-270))); +insert into t1 values (PointFromWKB(POINT(3.7857669957337e-270, 2.6355494858076e-82))); +insert into t1 values (PointFromWKB(POINT(2.0349165139404e+236, 3.8518598887745e-34))); +insert into t1 values (PointFromWKB(POINT(4.6566128730774e-10, 2.0880974297595e-53))); +insert into t1 values (PointFromWKB(POINT(2.0880974297595e-53, 1.8827498946116e-183))); +insert into t1 values (PointFromWKB(POINT(1.8033161362863e-130, 9.1248812352444e+192))); +insert into t1 values (PointFromWKB(POINT(4.7783097267365e-299, 2.2761049594727e-159))); +insert into t1 values (PointFromWKB(POINT(1.94906280228e+289, 1.2338789709327e-178))); +drop table t1; + # End of 4.1 tests