diff options
| author | Tor Didriksen <tor.didriksen@oracle.com> | 2010-10-08 11:52:09 +0200 |
|---|---|---|
| committer | Tor Didriksen <tor.didriksen@oracle.com> | 2010-10-08 11:52:09 +0200 |
| commit | c8d7a31f35bc988362ec07c2e2520a0dc511eebe (patch) | |
| tree | e07c26ac622c2655764f06411b76001761d4b9a0 /sql/item_strfunc.cc | |
| parent | 8284a3786d92158fcd5cc4fe5a305a87816562b5 (diff) | |
| download | mariadb-git-c8d7a31f35bc988362ec07c2e2520a0dc511eebe.tar.gz | |
Bug#57209 valgrind + Assertion failed: dst > buf
Buffer overrun when trying to format DBL_MAX
mysql-test/r/func_math.result:
Add test case for Bug#57209
mysql-test/t/func_math.test:
Add test case for Bug#57209
sql/item_strfunc.cc:
Allocate a larger buffer for the result.
Diffstat (limited to 'sql/item_strfunc.cc')
| -rw-r--r-- | sql/item_strfunc.cc | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index 6d3514bf356..89c1e785c71 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -2299,7 +2299,8 @@ String *Item_func_format::val_str_ascii(String *str) if (lc->grouping[0] > 0 && str_length >= dec_length + 1 + lc->grouping[0]) { - char buf[DECIMAL_MAX_STR_LENGTH * 2]; /* 2 - in the worst case when grouping=1 */ + /* We need space for ',' between each group of digits as well. */ + char buf[2 * FLOATING_POINT_BUFFER]; int count; const char *grouping= lc->grouping; char sign_length= *str->ptr() == '-' ? 1 : 0; @@ -2323,7 +2324,7 @@ String *Item_func_format::val_str_ascii(String *str) count will be initialized to -1 and we'll never get into this "if" anymore. */ - if (!count) + if (count == 0) { *--dst= lc->thousand_sep; if (grouping[1]) |