diff options
| author | unknown <svoj@mysql.com/june.mysql.com> | 2007-10-30 14:46:43 +0400 |
|---|---|---|
| committer | unknown <svoj@mysql.com/june.mysql.com> | 2007-10-30 14:46:43 +0400 |
| commit | b698b6fd945e5cd0e469e7494518b0a482f61e6e (patch) | |
| tree | 4bece81268f470eec4fb2213e8f90bfdca3fc13a /mysql-test/t/fulltext.test | |
| parent | 4fda18a3ec5de47fc96d5ea2e8521fc7c8adb87f (diff) | |
| download | mariadb-git-b698b6fd945e5cd0e469e7494518b0a482f61e6e.tar.gz | |
BUG#11392 - fulltext search bug
Fulltext boolean mode phrase search may crash server on platforms
where size of pointer is not equal to size of unsigned integer
(in other words some 64-bit platforms).
The problem was integer overflow.
Affects 4.1 only.
myisam/ft_boolean_search.c:
my_match_t::beg is unsigned int, that means type of expression
(m[0].beg - 1) has unsigned type too. It may happen that instr()
finds substring in the beggining of passed string, returning
m[0].beg equal to 0. In this case value of expression (m[0].beg - 1)
is equal to MAX_UINT.
This is not a problem on platforms where sizeof(pointer) equals to
sizeof(uint). That means ptr[(uint)-1] = ptr[(uint)MAX_UINT] = ptr - 1.
On some 64-bit platforms where sizeof(pointer) is 8 and sizeof(uint)
is 4, wrong address gets accessed. In other words ptr[(uint)-1] is
equal to ptr + MAX_UINT.
mysql-test/r/fulltext.result:
A test case for BUG#11392.
mysql-test/t/fulltext.test:
A test case for BUG#11392.
Diffstat (limited to 'mysql-test/t/fulltext.test')
| -rw-r--r-- | mysql-test/t/fulltext.test | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/mysql-test/t/fulltext.test b/mysql-test/t/fulltext.test index 1a9a6b578dc..661e93d8d87 100644 --- a/mysql-test/t/fulltext.test +++ b/mysql-test/t/fulltext.test @@ -379,4 +379,12 @@ ALTER TABLE t1 DISABLE KEYS; SELECT * FROM t1 WHERE MATCH(a) AGAINST('test'); DROP TABLE t1; +# +# BUG#11392 - fulltext search bug +# +CREATE TABLE t1(a TEXT); +INSERT INTO t1 VALUES(' aaaaa aaaa'); +SELECT * FROM t1 WHERE MATCH(a) AGAINST ('"aaaa"' IN BOOLEAN MODE); +DROP TABLE t1; + # End of 4.1 tests |