database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-09-02 09:41:40 +03:00
Code Activity

MDEV-17589: Stack-buffer-overflow with indexed varchar (utf8) field

Browse Source 
Create a new constant MAX_DATA_LENGTH_FOR_KEY.
Replace the value of MAX_KEY_LENGTH to also include the LENGTH and NULL BYTES
of a field.
This commit is contained in:
Varun Gupta
2018-12-19 10:34:30 +05:30
parent da4efd56aa
commit 7e606a2d5c
6 changed files with 79 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
mysql-test/r/func_group_innodb.result
View File

@@ -246,4 +246,34 @@ EXPLAIN SELECT MIN(c) FROM t1 GROUP BY b;
id select_type table type possible_keys key key_len ref rows Extra
1 SIMPLE t1 range NULL b 263 NULL 3 Using index for group-by
DROP TABLE t1;
#
# MDEV-17589: Stack-buffer-overflow with indexed varchar (utf8) field
#
set @save_innodb_file_format= @@innodb_file_format;
set @save_innodb_large_prefix= @@innodb_large_prefix;
set global innodb_file_format = BARRACUDA;
set global innodb_large_prefix = ON;
CREATE TABLE t1 (v1 varchar(1020), v2 varchar(2), v3 varchar(2),
KEY k1 (v3,v2,v1)) ENGINE=InnoDB CHARACTER SET=utf8 ROW_FORMAT=DYNAMIC;
INSERT INTO t1 VALUES ('king', 'qu','qu'), ('bad','go','go');
explain
SELECT MIN(t1.v1) FROM t1 where t1.v2='qu' and t1.v3='qu';
id select_type table type possible_keys key key_len ref rows Extra
1 SIMPLE NULL NULL NULL NULL NULL NULL NULL Select tables optimized away
SELECT MIN(t1.v1) FROM t1 where t1.v2='qu' and t1.v3='qu';
MIN(t1.v1)
king
drop table t1;
CREATE TABLE t1 (v1 varchar(1024) CHARACTER SET utf8, KEY v1 (v1)) ENGINE=InnoDB ROW_FORMAT=DYNAMIC;
INSERT INTO t1 VALUES ('king'), ('bad');
explain
SELECT MIN(x.v1) FROM (SELECT t1.* FROM t1 WHERE t1.v1 >= 'p') x;
id select_type table type possible_keys key key_len ref rows Extra
1 SIMPLE NULL NULL NULL NULL NULL NULL NULL No matching min/max row
SELECT MIN(x.v1) FROM (SELECT t1.* FROM t1 WHERE t1.v1 >= 'p') x;
MIN(x.v1)
NULL
drop table t1;
set global innodb_file_format = @save_innodb_file_format;
set global innodb_large_prefix = @save_innodb_large_prefix;
End of 5.5 tests