summaryrefslogtreecommitdiff
path: root/heap
diff options
context:
space:
mode:
authorTor Didriksen <tor.didriksen@oracle.com>2011-10-14 10:09:53 +0200
committerTor Didriksen <tor.didriksen@oracle.com>2011-10-14 10:09:53 +0200
commita6145f4b62bd264ad32d2dade98eda0cc6de0dba (patch)
tree4d1c0384335e1563abfd2762870081b91f2ef6c0 /heap
parent98231daa6f4374a125317993ca7952a37c506b56 (diff)
downloadmariadb-git-a6145f4b62bd264ad32d2dade98eda0cc6de0dba.tar.gz
Bug#12563865 ROUNDED,TMP_BUF,DECIMAL_VALUE STACK CORRUPTION IN ALL VERSIONS >=5.0
Buffer over-run on all platforms, crash on windows, wrong result on other platforms, when rounding numbers which start with 999999999 and have precision = 9 or 18 or 27 or 36 ... mysql-test/r/type_newdecimal.result: New test cases. mysql-test/t/type_newdecimal.test: New test cases. sql/my_decimal.h: Add sanity checking code, to catch buffer over/under-run. strings/decimal.c: The original initialization of intg1 (add 1 if buf[0] == DIG_MAX) will set p1 to point outside the buffer, and the loop to copy the original value while (buf0 < p0) *(--p1) = *(--p0); will overwrite memory outside the my_decimal object.
Diffstat (limited to 'heap')
0 files changed, 0 insertions, 0 deletions