mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 03:52:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-8407 Numeric errors, server crash with COLUMN_JSON() on DECIMAL with precision > 40

Browse source 
In fact it was error in decimal library (incorrect processing of buffer overflow) invisible from other server parts because of buffer allocation and precision tests.
This commit is contained in:
Oleksandr Byelkin 2015-12-10 11:22:53 +01:00
parent d67aacb4fb
commit fa25921b59
2 changed files with 34 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
strings/decimal.c
View file

@ -383,7 +383,8 @@ int decimal2string(const decimal_t *from, char *to, int *to_len,
}
else
frac-=j;
len= from->sign + intg_len + test(frac) + frac_len;
frac_len= frac;
len= from->sign + intg_len + test(frac) + frac;
}
*to_len=len;
s[len]=0;

32
unittest/my_decimal/my_decimal-t.cc
View file

@ -61,12 +61,42 @@ test_copy_and_compare()
}
static int
test_decimal2string()
{
decimal_t d1;
decimal_digit_t buffer[DECIMAL_BUFF_LENGTH+2];
char *str_end;
const char strnum[]= "0.1234567890123456789012345678901234567890123467";
char strbuff[50];
int len= 40;
int i;
bzero(strbuff, sizeof(strbuff));
str_end= (char *)(strnum + (sizeof(strnum) - 1));
d1.len= DECIMAL_BUFF_LENGTH + 2;
d1.buf= buffer;
string2decimal(strnum, &d1, &str_end);
decimal2string(&d1, strbuff, &len, 0, 0, 'X');
/* last digit is not checked due to possible rounding */
for (i= 0; i < 38 && strbuff[i] == strnum[i]; i++);
ok(i == 38, "Number");
for (i= 39; i < 50 && strbuff[i] == 0; i++);
ok(i == 50, "No overrun");
return 0;
}
int main()
{
plan(13);
plan(15);
diag("Testing my_decimal constructor and assignment operators");
test_copy_and_compare();
test_decimal2string();
return exit_status();
}