diff options
| author | unknown <evgen@moonbone.local> | 2007-01-19 18:34:09 +0300 |
|---|---|---|
| committer | unknown <evgen@moonbone.local> | 2007-01-19 18:34:09 +0300 |
| commit | 5effa05d3f31971461da851f0650951e1e488421 (patch) | |
| tree | 2261174445362ee68b36085a334b263371a58648 /mysql-test/r/select.result | |
| parent | 759a028c20412d26802d479724de932a288a3e43 (diff) | |
| download | mariadb-git-5effa05d3f31971461da851f0650951e1e488421.tar.gz | |
Bug#25172: Not checked buffer size leads to a server crash.
After fix for bug#21798 JOIN stores the pointer to the buffer for sorting
fields. It is used while sorting for grouping and for ordering. If ORDER BY
clause has more elements then the GROUP BY clause then a memory overrun occurs.
Now the length of the ORDER BY list is always passed to the
make_unireg_sortorder() function and it allocates buffer big enough to be
used for bigger list.
sql/sql_delete.cc:
Bug#25172: Not checked buffer size leads to a server crash.
Length parameter is initialized to 0 for the make_unireg_sortorder() function.
sql/sql_select.cc:
Bug#25172: Not checked buffer size leads to a server crash.
Now the length of the ORDER BY list is always passed to the
make_unireg_sortorder() function and it allocates buffer big enough to be
used for bigger list.
sql/sql_table.cc:
Bug#25172: Not checked buffer size leads to a server crash.
Length parameter is initialized to 0 for the make_unireg_sortorder() function.
sql/sql_update.cc:
Bug#25172: Not checked buffer size leads to a server crash.
Length parameter is initialized to 0 for the make_unireg_sortorder() function.
mysql-test/r/select.result:
Added a test case for bug#25172: Not checked buffer size leads to a server crash.
mysql-test/t/select.test:
Added a test case for bug#25172: Not checked buffer size leads to a server crash.
Diffstat (limited to 'mysql-test/r/select.result')
| -rw-r--r-- | mysql-test/r/select.result | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/mysql-test/r/select.result b/mysql-test/r/select.result index 44063c1e890..d890510ee67 100644 --- a/mysql-test/r/select.result +++ b/mysql-test/r/select.result @@ -3611,3 +3611,11 @@ id select_type table type possible_keys key key_len ref rows Extra 1 SIMPLE t2 range si,ai si 5 NULL 2 Using where 1 SIMPLE t3 eq_ref PRIMARY,ci PRIMARY 4 test.t2.a 1 Using where DROP TABLE t1,t2,t3; +CREATE TABLE t1 ( f1 int primary key, f2 int, f3 int, f4 int, f5 int, f6 int, checked_out int); +CREATE TABLE t2 ( f11 int PRIMARY KEY ); +INSERT INTO t1 VALUES (1,1,1,0,0,0,0),(2,1,1,3,8,1,0),(3,1,1,4,12,1,0); +INSERT INTO t2 VALUES (62); +SELECT * FROM t1 LEFT JOIN t2 ON f11 = t1.checked_out GROUP BY f1 ORDER BY f2, f3, f4, f5 LIMIT 0, 1; +f1 f2 f3 f4 f5 f6 checked_out f11 +1 1 1 0 0 0 0 NULL +DROP TABLE t1, t2; |