diff options
| author | Kristofer Pettersson <kpettersson@mysql.com> | 2008-09-20 10:51:03 +0200 |
|---|---|---|
| committer | Kristofer Pettersson <kpettersson@mysql.com> | 2008-09-20 10:51:03 +0200 |
| commit | 18b3eacbc647084e392c977359b5051807294791 (patch) | |
| tree | cab4087b617d73f6e364a0e4112bb80ede44a1c7 /sql/field.cc | |
| parent | 674d57be854daac6c0305467e79131a67294963c (diff) | |
| download | mariadb-git-18b3eacbc647084e392c977359b5051807294791.tar.gz | |
Bug#38469 invalid memory read and/or crash with utf8 text field, stored procedure, uservar
A stored procedure involving substrings could crash the server on certain
platforms because of invalid memory reads.
During storing the new blob-field value, the cached value's address range
overlapped that of the new field value. This caused problems when the
cached value storage was reallocated to provide access for a new
characater set representation. The patch checks the address ranges, and if
they overlap, the new field value is copied to a new storage before it is
converted to the new character set.
Diffstat (limited to 'sql/field.cc')
| -rw-r--r-- | sql/field.cc | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/sql/field.cc b/sql/field.cc index d840034f8dc..3d3f698f912 100644 --- a/sql/field.cc +++ b/sql/field.cc @@ -6992,8 +6992,18 @@ int Field_blob::store(const char *from,uint length,CHARSET_INFO *cs) return 0; } - if (from == value.ptr()) + /* + If the 'from' address is in the range of the temporary 'value'- + object we need to copy the content to a different location or it will be + invalidated when the 'value'-object is reallocated to make room for + the new character set. + */ + if (from >= value.ptr() && from <= value.ptr()+value.length()) { + /* + If content of the 'from'-address is cached in the 'value'-object + it is possible that the content needs a character conversion. + */ uint32 dummy_offset; if (!String::needs_conversion(length, cs, field_charset, &dummy_offset)) { |