diff options
| author | unknown <dkatz@damien-katzs-computer.local> | 2007-05-16 16:14:13 -0400 |
|---|---|---|
| committer | unknown <dkatz@damien-katzs-computer.local> | 2007-05-16 16:14:13 -0400 |
| commit | 3770083b5be2f2560fc1307c18e16fdc758ff4f2 (patch) | |
| tree | 737b47a5d91767cfbf2a66cd8ed935b36a371408 /myisam | |
| parent | bcae429e91860551a6acbcbd5bc6811b3c5a7372 (diff) | |
| download | mariadb-git-3770083b5be2f2560fc1307c18e16fdc758ff4f2.tar.gz | |
Bug #27119 server crash with integer division by zero during filesort on huge result
Added checks to detect integer overflow and fixed other bugs on the error path.
myisam/sort.c:
Replaced a break statement with a goto statement so that a failure will instead break
sql/filesort.cc:
Fixed an allocation routine to detect integer overflow, and as an optimization a check that prevents the number of buffpeks being larger than can possibly fit into memory.
Fixed several unchecked error codes.
Changed an index variable from int to uint to the match the type of the variable it's
being compared with.
Replaced a break statement with a goto statement so that a failure will instead break
out of the higher level while-loop, instead of just the nested for-loop.
Diffstat (limited to 'myisam')
| -rw-r--r-- | myisam/sort.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/myisam/sort.c b/myisam/sort.c index 3cb48b47b2c..f918283503e 100644 --- a/myisam/sort.c +++ b/myisam/sort.c @@ -773,7 +773,7 @@ static int NEAR_F merge_many_buff(MI_SORT_PARAM *info, uint keys, { if (merge_buffers(info,keys,from_file,to_file,sort_keys,lastbuff++, buffpek+i,buffpek+i+MERGEBUFF-1)) - break; /* purecov: inspected */ + goto cleanup; } if (merge_buffers(info,keys,from_file,to_file,sort_keys,lastbuff++, buffpek+i,buffpek+ *maxbuffer)) @@ -783,6 +783,7 @@ static int NEAR_F merge_many_buff(MI_SORT_PARAM *info, uint keys, temp=from_file; from_file=to_file; to_file=temp; *maxbuffer= (int) (lastbuff-buffpek)-1; } +cleanup: close_cached_file(to_file); /* This holds old result */ if (to_file == t_file) *t_file=t_file2; /* Copy result file */ |