mirror of
https://github.com/MariaDB/server.git
synced 2025-07-29 05:21:33 +03:00
Merge with 4.0.6
BitKeeper/etc/ignore: auto-union acinclude.m4: Auto merged configure.in: Auto merged heap/hp_delete.c: Auto merged heap/hp_scan.c: Auto merged include/my_base.h: Auto merged libmysql/libmysql.c: Auto merged libmysqld/lib_sql.cc: Auto merged myisam/mi_check.c: Auto merged myisam/mi_rnext_same.c: Auto merged myisam/sort.c: Auto merged mysql-test/r/alter_table.result: Auto merged mysql-test/r/distinct.result: Auto merged mysql-test/r/func_math.result: Auto merged mysql-test/r/group_by.result: Auto merged mysql-test/r/innodb.result: Auto merged mysql-test/r/select.result: Auto merged mysql-test/t/group_by.test: Auto merged mysql-test/t/select.test: Auto merged mysys/hash.c: Auto merged sql/field.h: Auto merged sql/field_conv.cc: Auto merged sql/ha_innodb.cc: Auto merged sql/handler.cc: Auto merged sql/item_func.cc: Auto merged sql/item_func.h: Auto merged sql/log.cc: Auto merged sql/mysql_priv.h: Auto merged sql/mysqld.cc: Auto merged sql/opt_sum.cc: Auto merged sql/set_var.cc: Auto merged sql/set_var.h: Auto merged sql/sql_analyse.cc: Auto merged sql/sql_class.cc: Auto merged sql/sql_show.cc: Auto merged sql/sql_table.cc: Auto merged sql/sql_udf.cc: Auto merged sql/structs.h: Auto merged sql/uniques.cc: Auto merged strings/strto.c: Auto merged vio/vio.c: Auto merged BitKeeper/triggers/post-commit: Add changeset to commit messages sql-bench/crash-me.sh: Use version from 4.0 sql-bench/server-cfg.sh: Use version from 4.0
This commit is contained in:
@ -554,7 +554,7 @@ net_safe_read(MYSQL *mysql)
|
||||
DBUG_PRINT("error",("Wrong connection or packet. fd: %s len: %d",
|
||||
vio_description(net->vio),len));
|
||||
end_server(mysql);
|
||||
net->last_errno=(net->last_errno == ER_NET_PACKET_TOO_LARGE ?
|
||||
net->last_errno=(net->last_errno == ER_NET_PACKET_TOO_LARGE ?
|
||||
CR_NET_PACKET_TOO_LARGE:
|
||||
CR_SERVER_LOST);
|
||||
strmov(net->last_error,ER(net->last_errno));
|
||||
@ -1196,7 +1196,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
|
||||
ulong pkt_len;
|
||||
ulong len;
|
||||
uchar *cp;
|
||||
char *to;
|
||||
char *to, *end_to;
|
||||
MYSQL_DATA *result;
|
||||
MYSQL_ROWS **prev_ptr,*cur;
|
||||
NET *net = &mysql->net;
|
||||
@ -1242,6 +1242,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
|
||||
*prev_ptr=cur;
|
||||
prev_ptr= &cur->next;
|
||||
to= (char*) (cur->data+fields+1);
|
||||
end_to=to+pkt_len-1;
|
||||
for (field=0 ; field < fields ; field++)
|
||||
{
|
||||
if ((len=(ulong) net_field_length(&cp)) == NULL_LENGTH)
|
||||
@ -1251,6 +1252,13 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
|
||||
else
|
||||
{
|
||||
cur->data[field] = to;
|
||||
if (to+len > end_to)
|
||||
{
|
||||
free_rows(result);
|
||||
net->last_errno=CR_MALFORMED_PACKET;
|
||||
strmov(net->last_error,ER(net->last_errno));
|
||||
DBUG_RETURN(0);
|
||||
}
|
||||
memcpy(to,(char*) cp,len); to[len]=0;
|
||||
to+=len+1;
|
||||
cp+=len;
|
||||
|
Reference in New Issue
Block a user