database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

Bug#57209 valgrind + Assertion failed: dst > buf

Browse Source 
Buffer overrun when trying to format DBL_MAX


mysql-test/r/func_math.result:
  Add test case for Bug#57209
mysql-test/t/func_math.test:
  Add test case for Bug#57209
sql/item_strfunc.cc:
  Allocate a larger buffer for the result.
This commit is contained in:
Tor Didriksen
2010-10-08 11:52:09 +02:00
parent 8284a3786d
commit c8d7a31f35
3 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
mysql-test/r/func_math.result
View File

@ -600,3 +600,10 @@ NULL
SELECT -9223372036854775808 MOD -1; SELECT -9223372036854775808 MOD -1;
-9223372036854775808 MOD -1 -9223372036854775808 MOD -1
0 0
#
# Bug #57209 valgrind + Assertion failed: dst > buf
#
SELECT floor(log10(format(concat_ws(5445796E25, 5306463, 30837), -358821)))
as foo;
foo
2

6
mysql-test/t/func_math.test
View File

@ -458,3 +458,9 @@ SELECT 2 DIV -2;
SELECT -(1 DIV 0); SELECT -(1 DIV 0);
# Crashed the server with SIGFPE before the bugfix # Crashed the server with SIGFPE before the bugfix
SELECT -9223372036854775808 MOD -1; SELECT -9223372036854775808 MOD -1;
--echo #
--echo # Bug #57209 valgrind + Assertion failed: dst > buf
--echo #
SELECT floor(log10(format(concat_ws(5445796E25, 5306463, 30837), -358821)))
as foo;

5
sql/item_strfunc.cc
View File

@ -2299,7 +2299,8 @@ String *Item_func_format::val_str_ascii(String *str)
if (lc->grouping[0] > 0 && if (lc->grouping[0] > 0 &&
str_length >= dec_length + 1 + lc->grouping[0]) str_length >= dec_length + 1 + lc->grouping[0])
{ {
char buf[DECIMAL_MAX_STR_LENGTH * 2]; /* 2 - in the worst case when grouping=1 */ /* We need space for ',' between each group of digits as well. */
char buf[2 * FLOATING_POINT_BUFFER];
int count; int count;
const char *grouping= lc->grouping; const char *grouping= lc->grouping;
char sign_length= *str->ptr() == '-' ? 1 : 0; char sign_length= *str->ptr() == '-' ? 1 : 0;
@ -2323,7 +2324,7 @@ String *Item_func_format::val_str_ascii(String *str)
count will be initialized to -1 and count will be initialized to -1 and
we'll never get into this "if" anymore. we'll never get into this "if" anymore.
*/ */
if (!count) if (count == 0)
{ {
*--dst= lc->thousand_sep; *--dst= lc->thousand_sep;
if (grouping[1]) if (grouping[1])