database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

BUG#11766720 - setting storage engine to null segfaults mysqld

Browse Source 
MONTHNAME(0) claims that it is about to return NOT NULL
value, whereas it actually returns NULL.

As a result storage_engine variable (which cannot be NULL)
protection was bypassed and NULL value was accepted, causing
server crash.

Fixed MONTHNAME(0) to report valid NULL flag.
This commit is contained in:
Sergey Vojtovich
2011-02-18 11:10:30 +03:00
parent b2089dc80a
commit 4daaa02880
4 changed files with 27 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mysql-test/r/func_time.result
View File

@ -136,7 +136,7 @@ dayname("1962-03-03") dayname("1962-03-03")+0
Saturday 5
select monthname("1972-03-04"),monthname("1972-03-04")+0;
monthname("1972-03-04") monthname("1972-03-04")+0
March 3
March 0
select time_format(19980131000000,'%H|%I|%k|%l|%i|%p|%r|%S|%T');
time_format(19980131000000,'%H|%I|%k|%l|%i|%p|%r|%S|%T')
00|12|0|12|00|AM|12:00:00 AM|00|00:00:00
@ -1368,3 +1368,11 @@ SELECT SUBDATE(STR_TO_DATE(NULL,0), INTERVAL 1 HOUR);
SUBDATE(STR_TO_DATE(NULL,0), INTERVAL 1 HOUR)
NULL
#
# BUG#59895 - setting storage engine to null segfaults mysqld
#
SELECT MONTHNAME(0), MONTHNAME(0) IS NULL, MONTHNAME(0) + 1;
MONTHNAME(0) MONTHNAME(0) IS NULL MONTHNAME(0) + 1
NULL 1 NULL
SET storage_engine=NULL;
ERROR 42000: Variable 'storage_engine' can't be set to the value of 'NULL'
#

7
mysql-test/t/func_time.test
View File

@ -881,4 +881,11 @@ SELECT WEEK(STR_TO_DATE(NULL,0));
SELECT SUBDATE(STR_TO_DATE(NULL,0), INTERVAL 1 HOUR);
--echo #
--echo # BUG#59895 - setting storage engine to null segfaults mysqld
--echo #
SELECT MONTHNAME(0), MONTHNAME(0) IS NULL, MONTHNAME(0) + 1;
--error ER_WRONG_VALUE_FOR_VAR
SET storage_engine=NULL;
--echo #

13
sql/item_timefunc.cc
View File

@ -1133,16 +1133,13 @@ String* Item_func_monthname::val_str(String* str)
{
DBUG_ASSERT(fixed == 1);
const char *month_name;
uint month= (uint) val_int();
uint err;
MYSQL_TIME ltime;
if (null_value || !month)
{
null_value=1;
return (String*) 0;
}
null_value=0;
month_name= locale->month_names->type_names[month-1];
if ((null_value= (get_arg0_date(&ltime, TIME_FUZZY_DATE) || !ltime.month)))
return (String *) 0;
month_name= locale->month_names->type_names[ltime.month - 1];
str->copy(month_name, (uint) strlen(month_name), &my_charset_utf8_bin,
collation.collation, &err);
return str;

9
sql/item_timefunc.h
View File

@ -163,16 +163,19 @@ public:
};
class Item_func_monthname :public Item_func_month
class Item_func_monthname :public Item_str_func
{
MY_LOCALE *locale;
public:
Item_func_monthname(Item *a) :Item_func_month(a) {}
Item_func_monthname(Item *a) :Item_str_func(a) {}
const char *func_name() const { return "monthname"; }
String *val_str(String *str);
enum Item_result result_type () const { return STRING_RESULT; }
void fix_length_and_dec();
bool check_partition_func_processor(uchar *int_arg) {return TRUE;}
bool check_valid_arguments_processor(uchar *int_arg)
{
return !has_date_args();
}
};