diff options
| author | unknown <monty@narttu.mysql.fi> | 2003-09-24 14:33:23 +0300 |
|---|---|---|
| committer | unknown <monty@narttu.mysql.fi> | 2003-09-24 14:33:23 +0300 |
| commit | 931633bbbb2b0d1336cccd3923cbe98b533426a3 (patch) | |
| tree | 2dc31c2cc9196308a765bec6e54cfd85a1749281 /myisam/mi_packrec.c | |
| parent | 792aa09ee17b4ca88c92f297498237e46a4c7cf0 (diff) | |
| download | mariadb-git-931633bbbb2b0d1336cccd3923cbe98b533426a3.tar.gz | |
Correct fix for buffer overruns for compressed blobs.
(Bugs #770, #1304 and maybe #1295)
Diffstat (limited to 'myisam/mi_packrec.c')
| -rw-r--r-- | myisam/mi_packrec.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/myisam/mi_packrec.c b/myisam/mi_packrec.c index 1bd39aa900b..b21bf0b2163 100644 --- a/myisam/mi_packrec.c +++ b/myisam/mi_packrec.c @@ -743,7 +743,7 @@ static void uf_blob(MI_COLUMNDEF *rec, MI_BIT_BUFF *bit_buff, { ulong length=get_bits(bit_buff,rec->space_length_bits); uint pack_length=(uint) (end-to)-mi_portable_sizeof_char_ptr; - if (bit_buff->blob_pos+length > bit_buff->end) + if (bit_buff->blob_pos+length > bit_buff->blob_end) { bit_buff->error=1; bzero((byte*) to,(end-to)); @@ -1067,6 +1067,7 @@ uint _mi_pack_get_block_info(MI_INFO *myisam, MI_BLOCK_INFO *info, File file, &myisam->rec_buff))) return BLOCK_FATAL_ERROR; /* not enough memory */ myisam->bit_buff.blob_pos=(uchar*) myisam->rec_buff+info->rec_len; + myisam->bit_buff.blob_end= myisam->bit_buff.blob_pos+info->blob_len; myisam->blob_length=info->blob_len; } info->filepos=filepos+head_length; @@ -1243,6 +1244,7 @@ static uchar *_mi_mempack_get_block_info(MI_INFO *myisam,MI_BLOCK_INFO *info, &myisam->rec_buff))) return 0; /* not enough memory */ myisam->bit_buff.blob_pos=(uchar*) myisam->rec_buff; + myisam->bit_buff.blob_end= (uchar*) myisam->rec_buff + info->blob_len; } return header; } |