diff options
| author | unknown <sanja@montyprogram.com> | 2013-08-20 14:48:29 +0300 |
|---|---|---|
| committer | unknown <sanja@montyprogram.com> | 2013-08-20 14:48:29 +0300 |
| commit | 35b2883643e337a8ec9c3cf7494363ae9889119c (patch) | |
| tree | eb2e7d833ed965b30f8b8485cfdac31abfea6c97 /mysys/ma_dyncol.c | |
| parent | dafa458262fb47a2c9534bcc36088b15e26307c2 (diff) | |
| parent | b59738a598569ace75be5e63b7ed6ca69afe6ebc (diff) | |
| download | mariadb-git-35b2883643e337a8ec9c3cf7494363ae9889119c.tar.gz | |
merge 5.5 -> 10.0-base
Diffstat (limited to 'mysys/ma_dyncol.c')
| -rw-r--r-- | mysys/ma_dyncol.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/mysys/ma_dyncol.c b/mysys/ma_dyncol.c index 71ceceaf162..2ab5f443233 100644 --- a/mysys/ma_dyncol.c +++ b/mysys/ma_dyncol.c @@ -1913,7 +1913,8 @@ static size_t get_length_interval(uchar *entry, uchar *entry_next, if (entry_next >= header_end) return (last_offset - offset); if (type_and_offset_read_num(&type_next, &offset_next, - entry_next + COLUMN_NUMBER_SIZE, offset_size)) + entry_next + COLUMN_NUMBER_SIZE, offset_size) || + (offset_next > last_offset)) return DYNCOL_OFFSET_ERROR; return (offset_next - offset); } |