database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-25754 ASAN: stack-buffer-overflow in Field_newdate::val_str()

Browse Source 
Problem was that Field_newdate() didn't allocate a string big enough for
the result.
This commit is contained in:
Monty
2021-06-07 18:28:27 +03:00
parent b1009ddfc9
commit 233590a48d
3 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mysql-test/main/strings.result
View File

@ -17,3 +17,13 @@ SELECT length(ENCRYPT(a)) AS f, COUNT(*) FROM t1 GROUP BY f;
f COUNT(*) f COUNT(*)
13 2 13 2
DROP TABLE t1; DROP TABLE t1;
#
# MDEV-25754 ASAN: stack-buffer-overflow in Field_newdate::val_str
#
CREATE TABLE t1 (d DATE);
INSERT INTO t1 VALUES ('1920-03-02'),('2020-12-01');
SELECT LENGTH(CONCAT_WS(d, ' ')) FROM t1;
LENGTH(CONCAT_WS(d, ' '))
1
1
DROP TABLE t1;

9
mysql-test/main/strings.test
View File

@ -24,3 +24,12 @@ CREATE TABLE t1 (a DECIMAL(15,11) ZEROFILL);
INSERT INTO t1 (a) VALUES (0.1),(0.2); INSERT INTO t1 (a) VALUES (0.1),(0.2);
SELECT length(ENCRYPT(a)) AS f, COUNT(*) FROM t1 GROUP BY f; SELECT length(ENCRYPT(a)) AS f, COUNT(*) FROM t1 GROUP BY f;
DROP TABLE t1; DROP TABLE t1;
--echo #
--echo # MDEV-25754 ASAN: stack-buffer-overflow in Field_newdate::val_str
--echo #
CREATE TABLE t1 (d DATE);
INSERT INTO t1 VALUES ('1920-03-02'),('2020-12-01');
SELECT LENGTH(CONCAT_WS(d, ' ')) FROM t1;
DROP TABLE t1;

4
sql/field.cc
View File

@ -6751,7 +6751,7 @@ String *Field_newdate::val_str(String *val_buffer,
String *val_ptr __attribute__((unused))) String *val_ptr __attribute__((unused)))
{ {
DBUG_ASSERT(marked_for_read()); DBUG_ASSERT(marked_for_read());
val_buffer->alloc(field_length); val_buffer->alloc(field_length+1);
val_buffer->length(field_length); val_buffer->length(field_length);
uint32 tmp=(uint32) uint3korr(ptr); uint32 tmp=(uint32) uint3korr(ptr);
int part; int part;
@ -6923,7 +6923,7 @@ longlong Field_datetime0::val_int(void)
String *Field_datetime0::val_str(String *val_buffer, String *Field_datetime0::val_str(String *val_buffer,
String *val_ptr __attribute__((unused))) String *val_ptr __attribute__((unused)))
{ {
val_buffer->alloc(field_length); val_buffer->alloc(field_length+1);
val_buffer->length(field_length); val_buffer->length(field_length);
DBUG_ASSERT(marked_for_read()); DBUG_ASSERT(marked_for_read());