diff options
| author | Sergey Vojtovich <svoj@mariadb.org> | 2015-06-04 16:04:05 +0400 |
|---|---|---|
| committer | Sergey Vojtovich <svoj@mariadb.org> | 2015-06-05 10:44:11 +0400 |
| commit | a2bb9d263993783923ba8fc83d5b9ddd36dbe09d (patch) | |
| tree | 71b17cc8abe7c29972d0a66b95412502afb43e80 | |
| parent | b611ac06a736a5d8d4fcf0d81316343745d4113d (diff) | |
| download | mariadb-git-a2bb9d263993783923ba8fc83d5b9ddd36dbe09d.tar.gz | |
MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes mysqld
Server may crash if sanity checks of COLUMN_GET() fail.
COLUMN_GET() description generator expects parent CAST item, which may not have
been created due to failure of sanity checks. Then further attempt to report
an error may crash the server.
Fixed COLUMN_GET() description generator to handle such case.
| -rw-r--r-- | mysql-test/r/dyncol.result | 6 | ||||
| -rw-r--r-- | mysql-test/t/dyncol.test | 6 | ||||
| -rw-r--r-- | sql/item_strfunc.cc | 10 |
3 files changed, 22 insertions, 0 deletions
diff --git a/mysql-test/r/dyncol.result b/mysql-test/r/dyncol.result index aacb5363717..ca6908f449c 100644 --- a/mysql-test/r/dyncol.result +++ b/mysql-test/r/dyncol.result @@ -1444,3 +1444,9 @@ column_get(column_create(1, "18446744073709552001" as char), 1 as int) Warnings: Warning 1918 Encountered illegal value '18446744073709552001' when converting to INT Note 1105 Cast to signed converted positive out-of-range integer to it's negative complement +# +# MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes +# mysqld +# +SELECT COLUMN_GET(`x`, 'y' AS DECIMAL(5,34)); +ERROR 42000: Too big scale 34 specified for ''y''. Maximum is 30. diff --git a/mysql-test/t/dyncol.test b/mysql-test/t/dyncol.test index 68e10a5fffe..f0d9467420a 100644 --- a/mysql-test/t/dyncol.test +++ b/mysql-test/t/dyncol.test @@ -643,3 +643,9 @@ SELECT # select column_get(column_create(1, "18446744073709552001" as char), 1 as int); +--echo # +--echo # MDEV-7505 - Too large scale in DECIMAL dynamic column getter crashes +--echo # mysqld +--echo # +--error ER_TOO_BIG_SCALE +SELECT COLUMN_GET(`x`, 'y' AS DECIMAL(5,34)); diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index eedf1499403..aca66fc29e0 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -4467,6 +4467,16 @@ null: void Item_dyncol_get::print(String *str, enum_query_type query_type) { + /* + Parent cast doesn't exist yet, only print dynamic column name. This happens + when called from create_func_cast() / wrong_precision_error(). + */ + if (!str->length()) + { + args[1]->print(str, query_type); + return; + } + /* see create_func_dyncol_get */ DBUG_ASSERT(str->length() >= 5); DBUG_ASSERT(strncmp(str->ptr() + str->length() - 5, "cast(", 5) == 0); |