diff options
author | Monty <monty@mariadb.org> | 2021-02-16 15:22:22 +0200 |
---|---|---|
committer | Monty <monty@mariadb.org> | 2021-02-16 15:23:47 +0200 |
commit | 04b7288ba6f4de80a58abb3e9512b9e03bb1ff7c (patch) | |
tree | 40488ea104d1896ee9801fd59edf4ed907980aee | |
parent | 631e195f43020335faf385f5da54241ed0a21d2e (diff) | |
download | mariadb-git-04b7288ba6f4de80a58abb3e9512b9e03bb1ff7c.tar.gz |
Ensure that we do not allocate strings bigger than 4G in String objects.
This is needed as we are using uint32 for allocated and current length.
-rw-r--r-- | sql/sql_string.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sql/sql_string.cc b/sql/sql_string.cc index 9c57bb22085..fedf5f4a48a 100644 --- a/sql/sql_string.cc +++ b/sql/sql_string.cc @@ -37,6 +37,8 @@ bool Binary_string::real_alloc(size_t length) DBUG_ASSERT(arg_length > length); if (arg_length <= length) return TRUE; /* Overflow */ + if (arg_length >= UINT_MAX32) + return FALSE; str_length=0; if (Alloced_length < arg_length) { @@ -45,7 +47,6 @@ bool Binary_string::real_alloc(size_t length) arg_length,MYF(MY_WME | (thread_specific ? MY_THREAD_SPECIFIC : 0))))) return TRUE; - DBUG_ASSERT(length < UINT_MAX32); Alloced_length=(uint32) arg_length; alloced=1; } |