mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-30351 crash in Item_func_left::val_str

Browse source 
When using LEFT() function with a string that is without a charset,
the function crashes. This is because the function assumes that
the string has a charset, and tries to use it to calculate the
length of the string.

Two functions, UNHEX and WEIGHT_STRING, returned a string without
the charset being set to a not null value.

The fix is to set charset when calling val_str on these two functions.

Reviewed-by: Alexander Barkov <bar@mariadb.com>
Reviewed-by: Daniel Black <daniel@mariadb.org>
This commit is contained in:
Weijun Huang 2023-03-11 11:06:03 +01:00 • committed by Daniel Black
parent a6780df49b
commit f70de1451b
3 changed files with 19 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
mysql-test/main/func_str.result
View file

@ -5240,6 +5240,15 @@ DROP TABLE crash_test_2;
# Start of 10.4 tests
#
#
# MDEV-30351 crash in Item_func_left::val_str
#
SELECT WEIGHT_STRING('aa') IN (LEFT(WEIGHT_STRING('aaa'),4),'bbb') as expect_1;
expect_1
1
SELECT UNHEX('0032') in (LEFT(UNHEX('003200'), 2),'dog') as expect_1;
expect_1
1
#
# MDEV-21841 CONV() function truncates the result type to 21 symbol.
#
CREATE TABLE t1(i BIGINT);

10
mysql-test/main/func_str.test
View file

@ -2256,16 +2256,22 @@ CREATE TABLE crash_test_2 (
DROP TABLE t1;
DROP TABLE crash_test_2;
--echo #
--echo # End of 10.3 tests
--echo #
--echo #
--echo # Start of 10.4 tests
--echo #
--echo #
--echo # MDEV-30351 crash in Item_func_left::val_str
--echo #
SELECT WEIGHT_STRING('aa') IN (LEFT(WEIGHT_STRING('aaa'),4),'bbb') as expect_1;
SELECT UNHEX('0032') in (LEFT(UNHEX('003200'), 2),'dog') as expect_1;
--echo #
--echo # MDEV-21841 CONV() function truncates the result type to 21 symbol.
--echo #

2
sql/item_strfunc.cc
View file

@ -3729,6 +3729,7 @@ String *Item_func_weight_string::val_str(String *str)
flags);
DBUG_ASSERT(frm_length <= tmp_length);
str->set_charset(&my_charset_bin);
str->length(frm_length);
null_value= 0;
return str;
@ -3808,6 +3809,7 @@ String *Item_func_unhex::val_str(String *str)
from= res->ptr();
null_value= 0;
str->set_charset(&my_charset_bin);
str->length(length);
to= (char*) str->ptr();
if (res->length() % 2)