diff options
| author | Varun Gupta <varun.gupta@mariadb.com> | 2018-12-19 10:34:30 +0530 |
|---|---|---|
| committer | Varun Gupta <varun.gupta@mariadb.com> | 2018-12-19 10:38:46 +0530 |
| commit | 7e606a2d5ca59dbd901b7c8909214a0fc12fbadd (patch) | |
| tree | b3c9ae6e97a542395f6e6f41fc3f465ca7786872 /mysql-test | |
| parent | da4efd56aa9bc3c39d94a73eb216ca7f559ce734 (diff) | |
| download | mariadb-git-bb-10.0-varun.tar.gz | |
MDEV-17589: Stack-buffer-overflow with indexed varchar (utf8) fieldbb-10.0-varun
Create a new constant MAX_DATA_LENGTH_FOR_KEY.
Replace the value of MAX_KEY_LENGTH to also include the LENGTH and NULL BYTES
of a field.
Diffstat (limited to 'mysql-test')
| -rw-r--r-- | mysql-test/r/func_group_innodb.result | 30 | ||||
| -rw-r--r-- | mysql-test/t/func_group_innodb.test | 26 |
2 files changed, 56 insertions, 0 deletions
diff --git a/mysql-test/r/func_group_innodb.result b/mysql-test/r/func_group_innodb.result index 52d5922df95..17b3c1e797e 100644 --- a/mysql-test/r/func_group_innodb.result +++ b/mysql-test/r/func_group_innodb.result @@ -246,4 +246,34 @@ EXPLAIN SELECT MIN(c) FROM t1 GROUP BY b; id select_type table type possible_keys key key_len ref rows Extra 1 SIMPLE t1 range NULL b 263 NULL 3 Using index for group-by DROP TABLE t1; +# +# MDEV-17589: Stack-buffer-overflow with indexed varchar (utf8) field +# +set @save_innodb_file_format= @@innodb_file_format; +set @save_innodb_large_prefix= @@innodb_large_prefix; +set global innodb_file_format = BARRACUDA; +set global innodb_large_prefix = ON; +CREATE TABLE t1 (v1 varchar(1020), v2 varchar(2), v3 varchar(2), +KEY k1 (v3,v2,v1)) ENGINE=InnoDB CHARACTER SET=utf8 ROW_FORMAT=DYNAMIC; +INSERT INTO t1 VALUES ('king', 'qu','qu'), ('bad','go','go'); +explain +SELECT MIN(t1.v1) FROM t1 where t1.v2='qu' and t1.v3='qu'; +id select_type table type possible_keys key key_len ref rows Extra +1 SIMPLE NULL NULL NULL NULL NULL NULL NULL Select tables optimized away +SELECT MIN(t1.v1) FROM t1 where t1.v2='qu' and t1.v3='qu'; +MIN(t1.v1) +king +drop table t1; +CREATE TABLE t1 (v1 varchar(1024) CHARACTER SET utf8, KEY v1 (v1)) ENGINE=InnoDB ROW_FORMAT=DYNAMIC; +INSERT INTO t1 VALUES ('king'), ('bad'); +explain +SELECT MIN(x.v1) FROM (SELECT t1.* FROM t1 WHERE t1.v1 >= 'p') x; +id select_type table type possible_keys key key_len ref rows Extra +1 SIMPLE NULL NULL NULL NULL NULL NULL NULL No matching min/max row +SELECT MIN(x.v1) FROM (SELECT t1.* FROM t1 WHERE t1.v1 >= 'p') x; +MIN(x.v1) +NULL +drop table t1; +set global innodb_file_format = @save_innodb_file_format; +set global innodb_large_prefix = @save_innodb_large_prefix; End of 5.5 tests diff --git a/mysql-test/t/func_group_innodb.test b/mysql-test/t/func_group_innodb.test index c62d3d08496..a65d2326d0f 100644 --- a/mysql-test/t/func_group_innodb.test +++ b/mysql-test/t/func_group_innodb.test @@ -192,4 +192,30 @@ EXPLAIN SELECT MIN(c) FROM t1 GROUP BY b; DROP TABLE t1; +--echo # +--echo # MDEV-17589: Stack-buffer-overflow with indexed varchar (utf8) field +--echo # + +set @save_innodb_file_format= @@innodb_file_format; +set @save_innodb_large_prefix= @@innodb_large_prefix; +set global innodb_file_format = BARRACUDA; +set global innodb_large_prefix = ON; + +CREATE TABLE t1 (v1 varchar(1020), v2 varchar(2), v3 varchar(2), + KEY k1 (v3,v2,v1)) ENGINE=InnoDB CHARACTER SET=utf8 ROW_FORMAT=DYNAMIC; +INSERT INTO t1 VALUES ('king', 'qu','qu'), ('bad','go','go'); +explain +SELECT MIN(t1.v1) FROM t1 where t1.v2='qu' and t1.v3='qu'; +SELECT MIN(t1.v1) FROM t1 where t1.v2='qu' and t1.v3='qu'; +drop table t1; + +CREATE TABLE t1 (v1 varchar(1024) CHARACTER SET utf8, KEY v1 (v1)) ENGINE=InnoDB ROW_FORMAT=DYNAMIC; +INSERT INTO t1 VALUES ('king'), ('bad'); +explain +SELECT MIN(x.v1) FROM (SELECT t1.* FROM t1 WHERE t1.v1 >= 'p') x; +SELECT MIN(x.v1) FROM (SELECT t1.* FROM t1 WHERE t1.v1 >= 'p') x; +drop table t1; +set global innodb_file_format = @save_innodb_file_format; +set global innodb_large_prefix = @save_innodb_large_prefix; + --echo End of 5.5 tests |