database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-08 11:22:35 +03:00
Code Activity

MDEV-30351 crash in Item_func_left::val_str

Browse Source 
When using LEFT() function with a string that is without a charset,
the function crashes. This is because the function assumes that
the string has a charset, and tries to use it to calculate the
length of the string.

Two functions, UNHEX and WEIGHT_STRING, returned a string without
the charset being set to a not null value.

The fix is to set charset when calling val_str on these two functions.

Reviewed-by: Alexander Barkov <bar@mariadb.com>
Reviewed-by: Daniel Black <daniel@mariadb.org>
This commit is contained in:
Weijun Huang
2023-03-11 11:06:03 +01:00
committed by Daniel Black
parent a6780df49b
commit f70de1451b
3 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mysql-test/main/func_str.test
View File

@@ -2256,16 +2256,22 @@ CREATE TABLE crash_test_2 (
DROP TABLE t1;
DROP TABLE crash_test_2;
--echo #
--echo # End of 10.3 tests
--echo #
--echo #
--echo # Start of 10.4 tests
--echo #
--echo #
--echo # MDEV-30351 crash in Item_func_left::val_str
--echo #
SELECT WEIGHT_STRING('aa') IN (LEFT(WEIGHT_STRING('aaa'),4),'bbb') as expect_1;
SELECT UNHEX('0032') in (LEFT(UNHEX('003200'), 2),'dog') as expect_1;
--echo #
--echo # MDEV-21841 CONV() function truncates the result type to 21 symbol.
--echo #