diff options
author | Tor Didriksen <tor.didriksen@oracle.com> | 2011-10-14 10:09:53 +0200 |
---|---|---|
committer | Tor Didriksen <tor.didriksen@oracle.com> | 2011-10-14 10:09:53 +0200 |
commit | a6145f4b62bd264ad32d2dade98eda0cc6de0dba (patch) | |
tree | 4d1c0384335e1563abfd2762870081b91f2ef6c0 /heap | |
parent | 98231daa6f4374a125317993ca7952a37c506b56 (diff) | |
download | mariadb-git-a6145f4b62bd264ad32d2dade98eda0cc6de0dba.tar.gz |
Bug#12563865 ROUNDED,TMP_BUF,DECIMAL_VALUE STACK CORRUPTION IN ALL VERSIONS >=5.0
Buffer over-run on all platforms, crash on windows, wrong result on other platforms,
when rounding numbers which start with 999999999 and have
precision = 9 or 18 or 27 or 36 ...
mysql-test/r/type_newdecimal.result:
New test cases.
mysql-test/t/type_newdecimal.test:
New test cases.
sql/my_decimal.h:
Add sanity checking code, to catch buffer over/under-run.
strings/decimal.c:
The original initialization of intg1 (add 1 if buf[0] == DIG_MAX)
will set p1 to point outside the buffer, and the loop to copy the original value
while (buf0 < p0)
*(--p1) = *(--p0);
will overwrite memory outside the my_decimal object.
Diffstat (limited to 'heap')
0 files changed, 0 insertions, 0 deletions