diff options
| author | unknown <evgen@moonbone.local> | 2008-01-10 18:54:34 +0300 |
|---|---|---|
| committer | unknown <evgen@moonbone.local> | 2008-01-10 18:54:34 +0300 |
| commit | 1a8bcceb2d829f868421472995e65b66655d5d33 (patch) | |
| tree | c26dc85ae508d685a59f6a1c729602aa0055292e /sql/filesort.cc | |
| parent | 3dba2ea82afde56ed81eca263649a3b440a3f409 (diff) | |
| download | mariadb-git-1a8bcceb2d829f868421472995e65b66655d5d33.tar.gz | |
filesort.cc:
Bug#33675: Usage of an uninitialized memory by filesort in a subquery caused
server crash.
Free smaller buffer before allocating bigger one.
sql/filesort.cc:
Bug#33675: Usage of an uninitialized memory by filesort in a subquery caused
server crash.
Free smaller buffer before allocating bigger one.
Diffstat (limited to 'sql/filesort.cc')
| -rw-r--r-- | sql/filesort.cc | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/sql/filesort.cc b/sql/filesort.cc index 5a8e3627758..43b079e83d5 100644 --- a/sql/filesort.cc +++ b/sql/filesort.cc @@ -239,10 +239,14 @@ ha_rows filesort(THD *thd, TABLE *table, SORT_FIELD *sortorder, uint s_length, } else { + if (table_sort.buffpek && table_sort.buffpek_len < maxbuffer) + { + x_free(table_sort.buffpek); + table_sort.buffpek= 0; + } if (!(table_sort.buffpek= read_buffpek_from_file(&buffpek_pointers, maxbuffer, - (table_sort.buffpek_len < maxbuffer ? - NULL : table_sort.buffpek)))) + table_sort.buffpek))) goto err; buffpek= (BUFFPEK *) table_sort.buffpek; table_sort.buffpek_len= maxbuffer; |