database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-12-24 11:21:21 +03:00
Code Activity

Fixed bug#16752 Binary table files created in mysqld v4.1 caused buffer overrun

Browse Source 
and possibly server crash in mysqld v5.0.

Reported MyISAM table was created in mysqld 4.1 and contains varchar field.
When binary files of that table was moved to 5.0, mysqld treats that varchar 
field as a string field. 
In order to make grouping server calculates group buffer, and because
that field is string server assumes it has fixed length and doesn't add
space for length, but later that field is converted to varchar field. 
Due to this, when field values were actually copied, additional space for
length bytes is taken and buffer overrun occurs, which may lead to server crash.

The calc_group_buffer() function now reserves additional space for length
bytes for VAR_STRING fields, like for VARCHAR fields.
This commit is contained in:
evgen@moonbone.local
2006-02-08 15:12:48 +03:00
parent bba8155516
commit 3a3f8379cb
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
sql/sql_select.cc
View File

@@ -12717,11 +12717,12 @@ calc_group_buffer(JOIN *join,ORDER *group)
Field *field= group_item->get_tmp_table_field();
if (field)
{
if (field->type() == FIELD_TYPE_BLOB)
enum_field_types type;
if ((type= field->type()) == FIELD_TYPE_BLOB)
key_length+=MAX_BLOB_WIDTH; // Can't be used as a key
else if (field->type() == MYSQL_TYPE_VARCHAR)
else if (type == MYSQL_TYPE_VARCHAR || type == MYSQL_TYPE_VAR_STRING)
key_length+= field->field_length + HA_KEY_BLOB_LENGTH;
else if (field->type() == FIELD_TYPE_BIT)
else if (type == FIELD_TYPE_BIT)
{
/* Bit is usually stored as a longlong key for group fields */
key_length+= 8; // Big enough