diff options
| author | Alexander Barkov <bar@mysql.com> | 2010-11-11 13:25:23 +0300 |
|---|---|---|
| committer | Alexander Barkov <bar@mysql.com> | 2010-11-11 13:25:23 +0300 |
| commit | a5d6c009d4e956775642af284bd4f2755000bbec (patch) | |
| tree | c6f7021e2960150a80f50095d0a6d53262e74c33 /sql | |
| parent | 847dd091525ec9630cd570ffd531483b1beeddfd (diff) | |
| download | mariadb-git-a5d6c009d4e956775642af284bd4f2755000bbec.tar.gz | |
Bug#57257 Replace(ExtractValue(...)) causes MySQL crash
Bug#57820 extractvalue crashes
Problem: ExtractValue and Replace crashed in some cases
due to invalid handling of empty and NULL arguments.
Per file comments:
@mysql-test/r/ctype_ujis.result
@mysql-test/r/xml.result
@mysql-test/t/ctype_ujis.test
@mysql-test/t/xml.test
Adding tests
@sql/item_strfunc.cc
Make sure Item_func_replace::val_str safely handles empty strings.
@sql/item_xmlfunc.cc
set null_value if nodeset_func returned NULL,
which is possible when the second argument is an
unset user variable.
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/item_strfunc.cc | 8 | ||||
| -rw-r--r-- | sql/item_xmlfunc.cc | 4 |
2 files changed, 9 insertions, 3 deletions
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index 8fda281bd9e..fd5c47d25cb 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -904,9 +904,15 @@ String *Item_func_replace::val_str(String *str) search=res2->ptr(); search_end=search+from_length; redo: + DBUG_ASSERT(res->ptr() || !offset); ptr=res->ptr()+offset; strend=res->ptr()+res->length(); - end=strend-from_length+1; + /* + In some cases val_str() can return empty string + with ptr() == NULL and length() == 0. + Let's check strend to avoid overflow. + */ + end= strend ? strend - from_length + 1 : NULL; while (ptr < end) { if (*ptr == *search) diff --git a/sql/item_xmlfunc.cc b/sql/item_xmlfunc.cc index 3e20b90e68e..364311877e0 100644 --- a/sql/item_xmlfunc.cc +++ b/sql/item_xmlfunc.cc @@ -2790,12 +2790,12 @@ String *Item_func_xml_extractvalue::val_str(String *str) null_value= 0; if (!nodeset_func || !(res= args[0]->val_str(str)) || - !parse_xml(res, &pxml)) + !parse_xml(res, &pxml) || + !(res= nodeset_func->val_str(&tmp_value))) { null_value= 1; return 0; } - res= nodeset_func->val_str(&tmp_value); return res; } |