database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

Backporting Bug 14100466 from 5.6.

Browse Source
This commit is contained in:
Alexander Barkov
2012-08-17 13:14:04 +04:00
parent a5ddcaab74
commit 3fe9686201
2 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
sql/spatial.cc
View File

@ -525,12 +525,13 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len,
const char *wkb_end;
Gis_point p;
if (len < 4)
if (len < 4 ||
(n_points= wkb_get_uint(wkb, bo)) < 1 ||
n_points > max_n_points)
return 0;
n_points= wkb_get_uint(wkb, bo);
proper_length= 4 + n_points * POINT_DATA_SIZE;
if (!n_points || len < proper_length || res->reserve(proper_length))
if (len < proper_length || res->reserve(proper_length))
return 0;
res->q_append(n_points);
@ -1072,9 +1073,9 @@ uint Gis_multi_point::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo,
Gis_point p;
const char *wkb_end;
if (len < 4)
if (len < 4 ||
(n_points= wkb_get_uint(wkb, bo)) > max_n_points)
return 0;
n_points= wkb_get_uint(wkb, bo);
proper_size= 4 + n_points * (WKB_HEADER_SIZE + POINT_DATA_SIZE);
if (len < proper_size || res->reserve(proper_size))

8
sql/spatial.h
View File

@ -379,6 +379,10 @@ public:
class Gis_line_string: public Geometry
{
// Maximum number of points in LineString that can fit into String
static const uint32 max_n_points=
(uint32) (UINT_MAX32 - WKB_HEADER_SIZE - 4 /* n_points */) /
POINT_DATA_SIZE;
public:
Gis_line_string() {} /* Remove gcc warning */
virtual ~Gis_line_string() {} /* Remove gcc warning */
@ -435,6 +439,10 @@ public:
class Gis_multi_point: public Geometry
{
// Maximum number of points in MultiPoint that can fit into String
static const uint32 max_n_points=
(uint32) (UINT_MAX32 - WKB_HEADER_SIZE - 4 /* n_points */) /
(WKB_HEADER_SIZE + POINT_DATA_SIZE);
public:
Gis_multi_point() {} /* Remove gcc warning */
virtual ~Gis_multi_point() {} /* Remove gcc warning */