diff options
| author | Tor Didriksen <tor.didriksen@oracle.com> | 2013-09-09 14:20:50 +0200 |
|---|---|---|
| committer | Tor Didriksen <tor.didriksen@oracle.com> | 2013-09-09 14:20:50 +0200 |
| commit | 27c6c4e8ac690b3619b7ee2f8582b015e42ce346 (patch) | |
| tree | 89c449538f7571b65d5ba39fcc0b27938eed672b /sql/item_strfunc.cc | |
| parent | 28278b141009a44957986bba8f553040dffb1373 (diff) | |
| download | mariadb-git-27c6c4e8ac690b3619b7ee2f8582b015e42ce346.tar.gz | |
Bug#17296644 CONV(X, INT_MIN, INT_MIN) SEGFAULTS THE SERVER
Do not call abs(INT_MIN) as the result is undefined.
Diffstat (limited to 'sql/item_strfunc.cc')
| -rw-r--r-- | sql/item_strfunc.cc | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index f654d260564..363ca02fd7a 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -1,5 +1,5 @@ /* - Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. + Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -2928,7 +2928,9 @@ String *Item_func_conv::val_str(String *str) int to_base= (int) args[2]->val_int(); int err; + // Note that abs(INT_MIN) is undefined. if (args[0]->null_value || args[1]->null_value || args[2]->null_value || + from_base == INT_MIN || to_base == INT_MIN || abs(to_base) > 36 || abs(to_base) < 2 || abs(from_base) > 36 || abs(from_base) < 2 || !(res->length())) { |