mirror of
https://github.com/MariaDB/server.git
synced 2025-08-31 22:22:30 +03:00
Merge with 4.0.8
BitKeeper/etc/logging_ok: auto-union VC++Files/sql/mysqld.dsp: Auto merged acinclude.m4: Auto merged include/my_base.h: Auto merged include/myisam.h: Auto merged include/myisammrg.h: Auto merged libmysql/libmysql.c: Auto merged myisam/mi_check.c: Auto merged myisam/mi_write.c: Auto merged myisam/myisamdef.h: Auto merged mysql-test/mysql-test-run.sh: Auto merged mysql-test/r/case.result: Auto merged mysql-test/r/distinct.result: Auto merged mysql-test/r/fulltext.result: Auto merged mysql-test/r/key_diff.result: Auto merged mysql-test/r/multi_update.result: Auto merged mysql-test/r/order_by.result: Auto merged mysql-test/r/select.result: Auto merged mysql-test/r/show_check.result: Auto merged mysql-test/t/multi_update.test: Auto merged mysql-test/t/rpl_log_pos.test: Auto merged mysys/Makefile.am: Auto merged scripts/Makefile.am: Auto merged sql/field.cc: Auto merged sql/ha_innodb.cc: Auto merged sql/ha_myisam.cc: Auto merged sql/ha_myisammrg.cc: Auto merged sql/ha_myisammrg.h: Auto merged sql/item_cmpfunc.cc: Auto merged sql/item_create.h: Auto merged sql/item_func.cc: Auto merged sql/item_func.h: Auto merged sql/lex.h: Auto merged sql/log.cc: Auto merged sql/net_serv.cc: Auto merged sql/repl_failsafe.cc: Auto merged sql/set_var.h: Auto merged sql/slave.cc: Auto merged sql/slave.h: Auto merged sql/sql_acl.cc: Auto merged sql/sql_insert.cc: Auto merged sql/sql_load.cc: Auto merged sql/sql_select.cc: Auto merged sql/sql_udf.cc: Auto merged sql/sql_update.cc: Auto merged sql-bench/crash-me.sh: Auto merged sql-bench/server-cfg.sh: Auto merged sql/share/english/errmsg.txt: Auto merged sql/structs.h: Auto merged
This commit is contained in:
@@ -1269,7 +1269,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
|
||||
else
|
||||
{
|
||||
cur->data[field] = to;
|
||||
if (to+len > end_to)
|
||||
if (len > (ulong) (end_to - to))
|
||||
{
|
||||
free_rows(result);
|
||||
net->last_errno=CR_MALFORMED_PACKET;
|
||||
@@ -1315,7 +1315,7 @@ read_one_row(MYSQL *mysql,uint fields,MYSQL_ROW row, ulong *lengths)
|
||||
{
|
||||
uint field;
|
||||
ulong pkt_len,len;
|
||||
uchar *pos,*prev_pos;
|
||||
uchar *pos,*prev_pos, *end_pos;
|
||||
|
||||
if ((pkt_len=net_safe_read(mysql)) == packet_error)
|
||||
return -1;
|
||||
@@ -1327,6 +1327,7 @@ read_one_row(MYSQL *mysql,uint fields,MYSQL_ROW row, ulong *lengths)
|
||||
}
|
||||
prev_pos= 0; /* allowed to write at packet[-1] */
|
||||
pos=mysql->net.read_pos;
|
||||
end_pos=pos+pkt_len;
|
||||
for (field=0 ; field < fields ; field++)
|
||||
{
|
||||
if ((len=(ulong) net_field_length(&pos)) == NULL_LENGTH)
|
||||
@@ -1336,6 +1337,12 @@ read_one_row(MYSQL *mysql,uint fields,MYSQL_ROW row, ulong *lengths)
|
||||
}
|
||||
else
|
||||
{
|
||||
if (len > (ulong) (end_pos - pos))
|
||||
{
|
||||
mysql->net.last_errno=CR_UNKNOWN_ERROR;
|
||||
strmov(mysql->net.last_error,ER(mysql->net.last_errno));
|
||||
return -1;
|
||||
}
|
||||
row[field] = (char*) pos;
|
||||
pos+=len;
|
||||
*lengths++=len;
|
||||
|
Reference in New Issue
Block a user