diff options
author | unknown <bar@mysql.com> | 2007-05-02 13:18:07 +0500 |
---|---|---|
committer | unknown <bar@mysql.com> | 2007-05-02 13:18:07 +0500 |
commit | 9c2923fef4bbf671123f75236a2411cdfb66e2e4 (patch) | |
tree | a635a5106e1a6ddc6ff968289f3571ab9b9e13b5 | |
parent | df22909536a7f054a224a5937b0991139a1954cf (diff) | |
download | mariadb-git-9c2923fef4bbf671123f75236a2411cdfb66e2e4.tar.gz |
Bug#27898 UPDATEXML Crashes the Server!
Problem: when replacing the root element, UpdateXML
erroneously tried to mix old XML content with the
replacement string, which led to crash.
Fix: don't use the old XML content in these cases,
just return the replacement string.
mysql-test/r/xml.result:
Adding test case
mysql-test/t/xml.test:
Adding test case
sql/item_xmlfunc.cc:
Adding special code to handle replacements of the root element -
the replacing content is just copied to the result,
the previous content of the XML value is removed.
-rw-r--r-- | mysql-test/r/xml.result | 7 | ||||
-rw-r--r-- | mysql-test/t/xml.test | 7 | ||||
-rw-r--r-- | sql/item_xmlfunc.cc | 10 |
3 files changed, 24 insertions, 0 deletions
diff --git a/mysql-test/r/xml.result b/mysql-test/r/xml.result index 236c50774bd..82f83e079e7 100644 --- a/mysql-test/r/xml.result +++ b/mysql-test/r/xml.result @@ -547,6 +547,13 @@ UpdateXML(@xml, '/a/b/@bb2', '') select UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"'); UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"') <a aa1="aa1" aa2="aa2"><b bb1="bb1" bb3="bb3">bb</b></a> +select updatexml('<div><div><span>1</span><span>2</span></div></div>', +'/','<tr><td>1</td><td>2</td></tr>') as upd1; +upd1 +<tr><td>1</td><td>2</td></tr> +select updatexml('', '/', '') as upd2; +upd2 + SET @xml= '<order><clerk>lesser wombat</clerk></order>'; select extractvalue(@xml,'order/clerk'); extractvalue(@xml,'order/clerk') diff --git a/mysql-test/t/xml.test b/mysql-test/t/xml.test index 8517dce111f..88ea519e610 100644 --- a/mysql-test/t/xml.test +++ b/mysql-test/t/xml.test @@ -232,6 +232,13 @@ select UpdateXML(@xml, '/a/b/@bb2', ''); select UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"'); # +# Bug#27898 UPDATEXML Crashes the Server! +# +select updatexml('<div><div><span>1</span><span>2</span></div></div>', + '/','<tr><td>1</td><td>2</td></tr>') as upd1; +select updatexml('', '/', '') as upd2; + +# # Bug#16234 XML: Crash if ExtractValue() # SET @xml= '<order><clerk>lesser wombat</clerk></order>'; diff --git a/sql/item_xmlfunc.cc b/sql/item_xmlfunc.cc index 26474990644..d29738429b7 100644 --- a/sql/item_xmlfunc.cc +++ b/sql/item_xmlfunc.cc @@ -2768,6 +2768,16 @@ String *Item_func_xml_update::val_str(String *str) nodebeg+= fltbeg->num; + if (!nodebeg->level) + { + /* + Root element, without NameTest: + UpdateXML(xml, '/', 'replacement'); + Just return the replacement string. + */ + return rep; + } + tmp_value.length(0); tmp_value.set_charset(collation.collation); uint offs= nodebeg->type == MY_XML_NODE_TAG ? 1 : 0; |