database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-30351 crash in Item_func_left::val_str

Browse Source 
When using LEFT() function with a string that is without a charset,
the function crashes. This is because the function assumes that
the string has a charset, and tries to use it to calculate the
length of the string.

Two functions, UNHEX and WEIGHT_STRING, returned a string without
the charset being set to a not null value.

The fix is to set charset when calling val_str on these two functions.

Reviewed-by: Alexander Barkov <bar@mariadb.com>
Reviewed-by: Daniel Black <daniel@mariadb.org>
This commit is contained in:
Weijun Huang
2023-03-11 11:06:03 +01:00
committed by Daniel Black
parent a6780df49b
commit f70de1451b
3 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
mysql-test/main/func_str.result
View File

@ -5240,6 +5240,15 @@ DROP TABLE crash_test_2;
# Start of 10.4 tests # Start of 10.4 tests
# #
# #
# MDEV-30351 crash in Item_func_left::val_str
#
SELECT WEIGHT_STRING('aa') IN (LEFT(WEIGHT_STRING('aaa'),4),'bbb') as expect_1;
expect_1
1
SELECT UNHEX('0032') in (LEFT(UNHEX('003200'), 2),'dog') as expect_1;
expect_1
1
#
# MDEV-21841 CONV() function truncates the result type to 21 symbol. # MDEV-21841 CONV() function truncates the result type to 21 symbol.
# #
CREATE TABLE t1(i BIGINT); CREATE TABLE t1(i BIGINT);

10
mysql-test/main/func_str.test
View File

@ -2256,16 +2256,22 @@ CREATE TABLE crash_test_2 (
DROP TABLE t1; DROP TABLE t1;
DROP TABLE crash_test_2; DROP TABLE crash_test_2;
--echo # --echo #
--echo # End of 10.3 tests --echo # End of 10.3 tests
--echo # --echo #
--echo # --echo #
--echo # Start of 10.4 tests --echo # Start of 10.4 tests
--echo # --echo #
--echo #
--echo # MDEV-30351 crash in Item_func_left::val_str
--echo #
SELECT WEIGHT_STRING('aa') IN (LEFT(WEIGHT_STRING('aaa'),4),'bbb') as expect_1;
SELECT UNHEX('0032') in (LEFT(UNHEX('003200'), 2),'dog') as expect_1;
--echo # --echo #
--echo # MDEV-21841 CONV() function truncates the result type to 21 symbol. --echo # MDEV-21841 CONV() function truncates the result type to 21 symbol.
--echo # --echo #

2
sql/item_strfunc.cc
View File

@ -3729,6 +3729,7 @@ String *Item_func_weight_string::val_str(String *str)
flags); flags);
DBUG_ASSERT(frm_length <= tmp_length); DBUG_ASSERT(frm_length <= tmp_length);
str->set_charset(&my_charset_bin);
str->length(frm_length); str->length(frm_length);
null_value= 0; null_value= 0;
return str; return str;
@ -3808,6 +3809,7 @@ String *Item_func_unhex::val_str(String *str)
from= res->ptr(); from= res->ptr();
null_value= 0; null_value= 0;
str->set_charset(&my_charset_bin);
str->length(length); str->length(length);
to= (char*) str->ptr(); to= (char*) str->ptr();
if (res->length() % 2) if (res->length() % 2)