A fix and test case for Bug#5194 "Bulk Insert Failures with Prepared

Statements": 
- fix a couple of net->buff overruns in libmysql,
- check in the server that statement parameter count is less than
  65535 (maximum value supported by prepared statements protocol).
 

1 files changed, 19 insertions, 7 deletions

diff --git a/libmysql/libmysql.c b/libmysql/libmysql.c
index 5b3db5a1a47..f9a6202b761 100644
--- a/libmysql/libmysql.c
+++ b/libmysql/libmysql.c
@@ -1703,16 +1703,18 @@ static void stmt_update_metadata(MYSQL_STMT *stmt, MYSQL_ROWS *data);
 /**************** Misc utility functions ****************************/
 
 /*
-  Reallocate the NET package to be at least of 'length' bytes
+  Reallocate the NET package to have at least length bytes available.
 
   SYNPOSIS
-   my_realloc_str()
-   net                 The NET structure to modify
-   length              Ensure that net->buff is at least this big
+    my_realloc_str()
+    net                 The NET structure to modify.
+    length              Ensure that net->buff has space for at least
+                        this number of bytes.
 
   RETURN VALUES
-  0	ok
-  1	Error
+    0   Success.
+    1   Error, i.e. out of memory or requested packet size is bigger
+        than max_allowed_packet. The error code is stored in net->last_errno.
 */
 
 static my_bool my_realloc_str(NET *net, ulong length)
@@ -2365,7 +2367,7 @@ static my_bool store_param(MYSQL_STMT *stmt, MYSQL_BIND *param)
     */
     if ((my_realloc_str(net, *param->length)))
     {
-      set_stmt_error(stmt, CR_OUT_OF_MEMORY, unknown_sqlstate);
+      set_stmt_error(stmt, net->last_errno, unknown_sqlstate);
       DBUG_RETURN(1);
     }
     (*param->store_param_func)(net, param);
@@ -2427,6 +2429,11 @@ int cli_stmt_execute(MYSQL_STMT *stmt)
     net_clear(net);				/* Sets net->write_pos */
     /* Reserve place for null-marker bytes */
     null_count= (stmt->param_count+7) /8;
+    if (my_realloc_str(net, null_count + 1))
+    {
+      set_stmt_error(stmt, net->last_errno, unknown_sqlstate);
+      DBUG_RETURN(1);
+    }
     bzero((char*) net->write_pos, null_count);
     net->write_pos+= null_count;
     param_end= stmt->params + stmt->param_count;
@@ -2435,6 +2442,11 @@ int cli_stmt_execute(MYSQL_STMT *stmt)
     *(net->write_pos)++= (uchar) stmt->send_types_to_server;
     if (stmt->send_types_to_server)
     {
+      if (my_realloc_str(net, 2 * stmt->param_count))
+      {
+        set_stmt_error(stmt, net->last_errno, unknown_sqlstate);
+        DBUG_RETURN(1);
+      }
       /*
 	Store types of parameters in first in first package
 	that is sent to the server.