Merge mysql.com:/home/dellis/mysqlab/bk/mysql-4.0

into mysql.com:/home/dellis/bkl/bug-4.1

1 files changed, 6 insertions, 1 deletions

diff --git a/myisam/ft_nlq_search.c b/myisam/ft_nlq_search.c
index 83de6acdab9..7a506fd11c6 100644
--- a/myisam/ft_nlq_search.c
+++ b/myisam/ft_nlq_search.c
@@ -261,6 +261,10 @@ FT_INFO *ft_init_nlq_search(MI_INFO *info, uint keynr, byte *query,
 
   }
 
+  /*
+    If ndocs == 0, this will not allocate RAM for FT_INFO.doc[],
+    so if ndocs == 0, FT_INFO.doc[] must not be accessed.
+   */
   dlist=(FT_INFO *)my_malloc(sizeof(FT_INFO)+
 			     sizeof(FT_DOC)*(aio.dtree.elements_in_tree-1),
 			     MYF(0));
@@ -329,7 +333,8 @@ float ft_nlq_find_relevance(FT_INFO *handler,
     else
       a=c;
   }
-  if (docs[a].dpos == docid)
+  /* bounds check to avoid accessing unallocated handler->doc  */
+  if (a < handler->ndocs && docs[a].dpos == docid)
     return (float) docs[a].weight;
   else
     return 0.0;