diff options
| author | unknown <igor@rurik.mysql.com> | 2005-06-07 03:05:57 -0700 |
|---|---|---|
| committer | unknown <igor@rurik.mysql.com> | 2005-06-07 03:05:57 -0700 |
| commit | 4da133cabf43b4c53f33f5d529b2b7d7b43af3d5 (patch) | |
| tree | 1567594821af194ea5d889382825c2064b87ccf0 /sql/item_buff.cc | |
| parent | 936b9319b8219daffab3bc6650a02801bf53c8bd (diff) | |
| download | mariadb-git-4da133cabf43b4c53f33f5d529b2b7d7b43af3d5.tar.gz | |
sql_select.cc, item_buff.cc, item.h:
Fixed bug #11088: a crash for queries with GROUP BY a BLOB column
+ COUNT(DISTINCT...) due to an attempt to allocate a too large
buffer for the BLOB field.
Now the size of the buffer is limited by max_sort_length.
group_by.test, group_by.result:
Added a test case for bug #11088.
mysql-test/r/group_by.result:
Added a test case for bug #11088.
mysql-test/t/group_by.test:
Added a test case for bug #11088.
sql/item.h:
Fixed bug #11088: a crash for queries with GROUP BY a BLOB column
+ COUNT(DISTINCT...) due to an attempt to allocate a too large
buffer for the BLOB fields.
Now the size of the buffer is limited by max_sort_length.
sql/item_buff.cc:
Fixed bug #11088: a crash for queries with GROUP BY a BLOB column
+ COUNT(DISTINCT...) due to an attempt to allocate a too large
buffer for the BLOB fields.
Now the size of the buffer is limited by max_sort_length.
sql/sql_select.cc:
Fixed bug #11088: a crash for queries with GROUP BY a BLOB column
+ COUNT(DISTINCT...) due to an attempt to allocate a too large
buffer for the BLOB fields.
Now the size of the buffer is limited by max_sort_length.
Diffstat (limited to 'sql/item_buff.cc')
| -rw-r--r-- | sql/item_buff.cc | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sql/item_buff.cc b/sql/item_buff.cc index 1559cfe958e..2324205eb65 100644 --- a/sql/item_buff.cc +++ b/sql/item_buff.cc @@ -23,13 +23,13 @@ ** Create right type of item_buffer for an item */ -Item_buff *new_Item_buff(Item *item) +Item_buff *new_Item_buff(THD *thd, Item *item) { if (item->type() == Item::FIELD_ITEM && !(((Item_field *) item)->field->flags & BLOB_FLAG)) return new Item_field_buff((Item_field *) item); if (item->result_type() == STRING_RESULT) - return new Item_str_buff((Item_field *) item); + return new Item_str_buff(thd, (Item_field *) item); if (item->result_type() == INT_RESULT) return new Item_int_buff((Item_field *) item); return new Item_real_buff(item); @@ -42,12 +42,17 @@ Item_buff::~Item_buff() {} ** Return true if values have changed */ +Item_str_buff::Item_str_buff(THD *thd, Item *arg) + :item(arg), value(min(arg->max_length, thd->variables. max_sort_length)) +{} + bool Item_str_buff::cmp(void) { String *res; bool tmp; res=item->val_str(&tmp_value); + res->length(min(res->length(), value.alloced_length())); if (null_value != item->null_value) { if ((null_value= item->null_value)) |