diff options
| author | Kristofer Pettersson <kristofer.pettersson@oracle.com> | 2010-09-07 11:37:46 +0200 |
|---|---|---|
| committer | Kristofer Pettersson <kristofer.pettersson@oracle.com> | 2010-09-07 11:37:46 +0200 |
| commit | 5caea4a995130cd7c82574acc591ff7c46d9d978 (patch) | |
| tree | 21bc0951f74623f9452b1ede5596d2abf580f8df /sql/field.cc | |
| parent | 947c7f3029dea620429e4a56a26bbde80817bdc5 (diff) | |
| download | mariadb-git-5caea4a995130cd7c82574acc591ff7c46d9d978.tar.gz | |
Bug#55531 crash with conversions of geometry types / strings
Convertion from a floating point number to a string caused a
crash.
During rare circumstances a String object could crash when
it was requested to allocate new memory.
A crash could occcur in Field_double::val_str() because of
a pointer referencing memory inside a String object which was
of unknown size.
And finally, the geometric collection should not accept
arguments which are non geometric.
Diffstat (limited to 'sql/field.cc')
| -rw-r--r-- | sql/field.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/field.cc b/sql/field.cc index 619e6a780da..724f8e0af73 100644 --- a/sql/field.cc +++ b/sql/field.cc @@ -4561,7 +4561,7 @@ String *Field_double::val_str(String *val_buffer, #endif doubleget(nr,ptr); - uint to_length=max(field_length, DOUBLE_TO_STRING_CONVERSION_BUFFER_SIZE); + uint to_length= DOUBLE_TO_STRING_CONVERSION_BUFFER_SIZE; val_buffer->alloc(to_length); char *to=(char*) val_buffer->ptr(); |