database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-30351 crash in Item_func_left::val_str

Browse Source 
When using LEFT() function with a string that is without a charset,
the function crashes. This is because the function assumes that
the string has a charset, and tries to use it to calculate the
length of the string.

Two functions, UNHEX and WEIGHT_STRING, returned a string without
the charset being set to a not null value.

The fix is to set charset when calling val_str on these two functions.

Reviewed-by: Alexander Barkov <bar@mariadb.com>
Reviewed-by: Daniel Black <daniel@mariadb.org>
This commit is contained in:
Weijun Huang
2023-03-11 11:06:03 +01:00
committed by Daniel Black
parent a6780df49b
commit f70de1451b
3 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
mysql-test/main/func_str.result
View File

@ -5240,6 +5240,15 @@ DROP TABLE crash_test_2;
# Start of 10.4 tests
#
#
# MDEV-30351 crash in Item_func_left::val_str
#
SELECT WEIGHT_STRING('aa') IN (LEFT(WEIGHT_STRING('aaa'),4),'bbb') as expect_1;
expect_1
1
SELECT UNHEX('0032') in (LEFT(UNHEX('003200'), 2),'dog') as expect_1;
expect_1
1
#
# MDEV-21841 CONV() function truncates the result type to 21 symbol.
#
CREATE TABLE t1(i BIGINT);