database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

Bug #26281:

Browse Source 
Fixed boundry checks in the INSERT() function:
 were one off.
This commit is contained in:
gkodinov/kgeorge@magare.gmz
2007-03-09 12:47:12 +02:00
parent 999c1cdcc1
commit 740a5fd7fe
3 changed files with 25 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
mysql-test/r/func_str.result
View File

@ -1946,4 +1946,16 @@ NULL
SELECT UNHEX('G') IS NULL;
UNHEX('G') IS NULL
1
SELECT INSERT('abc', 3, 3, '1234');
INSERT('abc', 3, 3, '1234')
ab1234
SELECT INSERT('abc', 4, 3, '1234');
INSERT('abc', 4, 3, '1234')
abc1234
SELECT INSERT('abc', 5, 3, '1234');
INSERT('abc', 5, 3, '1234')
abc
SELECT INSERT('abc', 6, 3, '1234');
INSERT('abc', 6, 3, '1234')
abc
End of 5.0 tests

8
mysql-test/t/func_str.test
View File

@ -1014,4 +1014,12 @@ select lpad('abc', cast(5 as unsigned integer), 'x');
SELECT UNHEX('G');
SELECT UNHEX('G') IS NULL;
#
# Bug #26281: INSERT() function mishandles NUL on boundary condition
#
SELECT INSERT('abc', 3, 3, '1234');
SELECT INSERT('abc', 4, 3, '1234');
SELECT INSERT('abc', 5, 3, '1234');
SELECT INSERT('abc', 6, 3, '1234');
--echo End of 5.0 tests

10
sql/item_strfunc.cc
View File

@ -967,18 +967,18 @@ String *Item_func_insert::val_str(String *str)
args[3]->null_value)
goto null; /* purecov: inspected */
if ((start < 0) || (start > res->length() + 1))
if ((start < 0) || (start > res->length()))
return res; // Wrong param; skip insert
if ((length < 0) || (length > res->length() + 1))
length= res->length() + 1;
if ((length < 0) || (length > res->length()))
length= res->length();
/* start and length are now sufficiently valid to pass to charpos function */
start= res->charpos((int) start);
length= res->charpos((int) length, (uint32) start);
/* Re-testing with corrected params */
if (start > res->length() + 1)
return res; // Wrong param; skip insert
if (start > res->length())
return res; /* purecov: inspected */ // Wrong param; skip insert
if (length > res->length() - start)
length= res->length() - start;