diff options
author | evgen@moonbone.local <> | 2006-01-23 21:51:32 +0300 |
---|---|---|
committer | evgen@moonbone.local <> | 2006-01-23 21:51:32 +0300 |
commit | b1967ad723dd9f213099393aad13f1adec6cdc08 (patch) | |
tree | 8e8d79bca6e7a4a56ff9a65c37488f1853fae000 /mysql-test/r/update.result | |
parent | 0caa0104401d4bf15f59f5722af0de9207af18c1 (diff) | |
download | mariadb-git-b1967ad723dd9f213099393aad13f1adec6cdc08.tar.gz |
Fixed bug #16510: Updating field named like '*name' caused server crash.
When setup_fields() function finds field named '*' it expands it to the list
of all table fields. It does so by checking that the first char of
field_name is '*', but it doesn't checks that the '* is the only char.
Due to this, when updating table with a field named like '*name', such field
is wrongly treated as '*' and expanded. This leads to making list of fields
to update being longer than list of the new values. Later, the fill_record()
function crashes by dereferencing null when there is left fields to update,
but no more values.
Added check in the setup_fields() function which ensures that the field
expanding will be done only when '*' is the only char in the field name.
Diffstat (limited to 'mysql-test/r/update.result')
-rw-r--r-- | mysql-test/r/update.result | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/mysql-test/r/update.result b/mysql-test/r/update.result index 9ca92fe75df..46cf2d161ef 100644 --- a/mysql-test/r/update.result +++ b/mysql-test/r/update.result @@ -216,3 +216,7 @@ select * from t1; a b 0 2 drop table t1; +create table t1(f1 int, `*f2` int); +insert into t1 values (1,1); +update t1 set `*f2`=1; +drop table t1; |