diff options
| author | Kristofer Pettersson <kristofer.pettersson@oracle.com> | 2011-09-06 09:42:14 +0200 |
|---|---|---|
| committer | Kristofer Pettersson <kristofer.pettersson@oracle.com> | 2011-09-06 09:42:14 +0200 |
| commit | 1a2b1ba6aa972b622b41417171f51998d5753c7d (patch) | |
| tree | 0e8fc253abe87a09d09ce097fb1e7b993ebaac36 /sql/item_strfunc.cc | |
| parent | 553587678e6bcd9ea3618ee6c8f27bff98fb6f41 (diff) | |
| download | mariadb-git-1a2b1ba6aa972b622b41417171f51998d5753c7d.tar.gz | |
Bug11764310 - 57132: CONV FUNCTION CRASHES, NEGATIVE ARGUMENT TO MEMCPY
Failure to check the return state of a longlong2str() call
caused a crash. This could happen if a user executed the sql
function CONV() with certain parameters.
The patch fixes the issue by checking that the returned pointer
isn't NULL.
Diffstat (limited to 'sql/item_strfunc.cc')
| -rw-r--r-- | sql/item_strfunc.cc | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index 55087879b98..c6e9384bc5e 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -2952,8 +2952,8 @@ String *Item_func_conv::val_str(String *str) from_base, &endptr, &err); } - ptr= longlong2str(dec, ans, to_base); - if (str->copy(ans, (uint32) (ptr-ans), default_charset())) + if (!(ptr= longlong2str(dec, ans, to_base)) || + str->copy(ans, (uint32) (ptr - ans), default_charset())) return make_empty_result(); return str; } @@ -3113,8 +3113,10 @@ String *Item_func_hex::val_str_ascii(String *str) if ((null_value= args[0]->null_value)) return 0; - ptr= longlong2str(dec,ans,16); - if (str->copy(ans,(uint32) (ptr-ans), &my_charset_numeric)) + + if (!(ptr= longlong2str(dec, ans, 16)) || + str->copy(ans,(uint32) (ptr - ans), + &my_charset_numeric)) return make_empty_result(); // End of memory return str; } |