diff options
| author | bar@mysql.com/bar.myoffice.izhnet.ru <> | 2007-05-23 12:34:47 +0500 |
|---|---|---|
| committer | bar@mysql.com/bar.myoffice.izhnet.ru <> | 2007-05-23 12:34:47 +0500 |
| commit | 240a927c541b5cc9002e6dc17492ad001a2c2ba7 (patch) | |
| tree | 5b7b2e8723f789a9bd16272d476bdde8187337bf /mysql-test/t/xml.test | |
| parent | 0ce86cdc518254bd6a4d65556c687499431b0aec (diff) | |
| download | mariadb-git-240a927c541b5cc9002e6dc17492ad001a2c2ba7.tar.gz | |
Bug#28558 UpdateXML called with garbage crashes server
Problem: Memory overrun happened in attempts to generate
error messages (e.g. in case of incorrect XPath syntax).
Reason: set_if_bigger() was used instead of set_if_smaller().
Change: replacing wrong set_if_bigger() to set_if_smaller(),
and making minor additional code clean-ups.
Diffstat (limited to 'mysql-test/t/xml.test')
| -rw-r--r-- | mysql-test/t/xml.test | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/mysql-test/t/xml.test b/mysql-test/t/xml.test index 28abd3475d2..1d16652ab1e 100644 --- a/mysql-test/t/xml.test +++ b/mysql-test/t/xml.test @@ -523,3 +523,13 @@ CALL spxml('<a><b>b1</b><b>b2</b></a>', '1 and string'); CALL spxml('<a><b>b1</b><b>b2</b></a>', 'string and 1'); CALL spxml('<a><b>b1</b><b>b2</b></a>', 'string'); DROP PROCEDURE spxml; + +# +# Bug#28558 UpdateXML called with garbage crashes server +# +--error 1105 +select UpdateXML('<a>a</a>',repeat('a b ',1000),''); +--error 1105 +select ExtractValue('<a>a</a>', '/a[@x=@y0123456789_0123456789_0123456789_0123456789]'); +--error 1105 +select ExtractValue('<a>a</a>', '/a[@x=$y0123456789_0123456789_0123456789_0123456789]'); |