diff options
| author | unknown <serg@serg.mylan> | 2003-09-02 16:49:00 +0200 |
|---|---|---|
| committer | unknown <serg@serg.mylan> | 2003-09-02 16:49:00 +0200 |
| commit | 9de22b36373ec374f452320448fea9d04d4a08d5 (patch) | |
| tree | f9b074c6a7a0ab9eddde638039ca748230fdcc75 /myisam/mi_packrec.c | |
| parent | 91bbabed3bc03cc0369a53a9cc5304e543d4a505 (diff) | |
| download | mariadb-git-9de22b36373ec374f452320448fea9d04d4a08d5.tar.gz | |
more sanity checks for compressed files, BUG#770
Diffstat (limited to 'myisam/mi_packrec.c')
| -rw-r--r-- | myisam/mi_packrec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/myisam/mi_packrec.c b/myisam/mi_packrec.c index 7557bb8749f..1bd39aa900b 100644 --- a/myisam/mi_packrec.c +++ b/myisam/mi_packrec.c @@ -743,6 +743,12 @@ static void uf_blob(MI_COLUMNDEF *rec, MI_BIT_BUFF *bit_buff, { ulong length=get_bits(bit_buff,rec->space_length_bits); uint pack_length=(uint) (end-to)-mi_portable_sizeof_char_ptr; + if (bit_buff->blob_pos+length > bit_buff->end) + { + bit_buff->error=1; + bzero((byte*) to,(end-to)); + return; + } decode_bytes(rec,bit_buff,bit_buff->blob_pos,bit_buff->blob_pos+length); _my_store_blob_length((byte*) to,pack_length,length); memcpy_fixed((char*) to+pack_length,(char*) &bit_buff->blob_pos, |