diff options
| author | Alexey Kopytov <Alexey.Kopytov@sun.com> | 2009-02-03 20:19:01 +0300 |
|---|---|---|
| committer | Alexey Kopytov <Alexey.Kopytov@sun.com> | 2009-02-03 20:19:01 +0300 |
| commit | 887d1493fa45b528ed9aa93c6b1e50c2ab0c13dc (patch) | |
| tree | f878e9c7f35c92af0cfcc10bdffa8aa396ba5df8 /mysql-test/r/func_str.result | |
| parent | 6a834d1f4f8d41ef664c38f41408911080afebef (diff) | |
| download | mariadb-git-887d1493fa45b528ed9aa93c6b1e50c2ab0c13dc.tar.gz | |
Fix for bug #41868: crash or memory overrun with concat + upper, date_format
functions
String::realloc() did not check whether the existing string data fits in the newly
allocated buffer for cases when reallocating a String object with external buffer
(i.e.alloced == FALSE). This could lead to memory overruns in some cases.
Diffstat (limited to 'mysql-test/r/func_str.result')
| -rw-r--r-- | mysql-test/r/func_str.result | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/mysql-test/r/func_str.result b/mysql-test/r/func_str.result index c121c8937d7..d7fd8c5c887 100644 --- a/mysql-test/r/func_str.result +++ b/mysql-test/r/func_str.result @@ -2181,4 +2181,10 @@ def format(a, 2) 253 20 4 Y 0 2 8 format(a, 2) 1.33 drop table t1; +CREATE TABLE t1 (c DATE, aa VARCHAR(30)); +INSERT INTO t1 VALUES ('2008-12-31','aaaaaa'); +SELECT DATE_FORMAT(c, GET_FORMAT(DATE, 'eur')) h, CONCAT(UPPER(aa),', ', aa) i FROM t1; +h i +31.12.2008 AAAAAA, aaaaaa +DROP TABLE t1; End of 5.0 tests |