diff options
| author | Alexey Botchkov <holyfoot@askmonty.org> | 2013-03-10 23:08:05 +0400 |
|---|---|---|
| committer | Alexey Botchkov <holyfoot@askmonty.org> | 2013-03-10 23:08:05 +0400 |
| commit | 511b9432637510617b04bde92c51a184c1e3aea8 (patch) | |
| tree | ec8722e7d04b13f0bda411a5b2cd9dc89efd4570 /mysql-test/t/gis.test | |
| parent | 027e34e13b8d0baed51e26be8d4ffd86d9b3b041 (diff) | |
| download | mariadb-git-511b9432637510617b04bde92c51a184c1e3aea8.tar.gz | |
MDEV-4252 geometry query crashes server.
The bug was found by Alyssa Milburn.
If the number of points of a geometry feature read from
binary representation is greater than 0x10000000, then
the (uint32) (num_points * 16) will cut the higher byte,
which leads to various errors.
Fixed by additional check if (num_points > max_n_points).
Diffstat (limited to 'mysql-test/t/gis.test')
| -rw-r--r-- | mysql-test/t/gis.test | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/mysql-test/t/gis.test b/mysql-test/t/gis.test index abda3e997bd..cc5d158f600 100644 --- a/mysql-test/t/gis.test +++ b/mysql-test/t/gis.test @@ -826,5 +826,6 @@ SELECT ISCLOSED(CONVERT(CONCAT(' ', 0x2), BINARY(20))); --error ER_ILLEGAL_VALUE_FOR_TYPE SELECT GEOMETRYCOLLECTION((SELECT @@OLD)); +select astext(0x0100000000030000000100000000000010); --echo End of 5.1 tests |