diff options
| author | Sergei Golubchik <serg@mariadb.org> | 2018-05-04 17:35:09 +0200 |
|---|---|---|
| committer | Sergei Golubchik <serg@mariadb.org> | 2018-05-04 17:35:09 +0200 |
| commit | 3c07ed141c2ed885dea13fbce8603afce6250590 (patch) | |
| tree | f9385be5843b39de4ec630ea4544c26344ab8361 /sql-common | |
| parent | 04b1e61d69ebfdeab196c28ef19316b27f8588bc (diff) | |
| parent | 1d58d184c2c4ddd8a3b2be6f86d76c4e57bbe14f (diff) | |
| download | mariadb-git-3c07ed141c2ed885dea13fbce8603afce6250590.tar.gz | |
Merge branch '5.5' into 10.0
Diffstat (limited to 'sql-common')
| -rw-r--r-- | sql-common/client.c | 22 |
1 files changed, 15 insertions, 7 deletions
diff --git a/sql-common/client.c b/sql-common/client.c index 586c2effc1e..203e822d3da 100644 --- a/sql-common/client.c +++ b/sql-common/client.c @@ -1347,7 +1347,9 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields, { uchar *pos; /* fields count may be wrong */ - DBUG_ASSERT((uint) (field - result) < fields); + if (field - result >= fields) + goto err; + cli_fetch_lengths(&lengths[0], row->data, default_value ? 8 : 7); field->catalog= strmake_root(alloc,(char*) row->data[0], lengths[0]); field->db= strmake_root(alloc,(char*) row->data[1], lengths[1]); @@ -1365,12 +1367,7 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields, /* Unpack fixed length parts */ if (lengths[6] != 12) - { - /* malformed packet. signal an error. */ - free_rows(data); /* Free old data */ - set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate); - DBUG_RETURN(0); - } + goto err; pos= (uchar*) row->data[6]; field->charsetnr= uint2korr(pos); @@ -1397,6 +1394,8 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields, /* old protocol, for backward compatibility */ for (row=data->data; row ; row = row->next,field++) { + if (field - result >= fields) + goto err; cli_fetch_lengths(&lengths[0], row->data, default_value ? 6 : 5); field->org_table= field->table= strdup_root(alloc,(char*) row->data[0]); field->name= strdup_root(alloc,(char*) row->data[1]); @@ -1433,8 +1432,17 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields, } } #endif /* DELETE_SUPPORT_OF_4_0_PROTOCOL */ + if (field - result < fields) + goto err; free_rows(data); /* Free old data */ DBUG_RETURN(result); + +err: + /* malformed packet. signal an error. */ + free_rows(data); + free_root(alloc, MYF(0)); + set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate); + DBUG_RETURN(0); } /* Read all rows (fields or data) from server */ |