diff options
| author | unknown <evgen@moonbone.local> | 2005-12-09 23:01:52 +0300 |
|---|---|---|
| committer | unknown <evgen@moonbone.local> | 2005-12-09 23:01:52 +0300 |
| commit | cb06e0c1250074337293289e4914f01911e68ec5 (patch) | |
| tree | 0b1b00a9d1f4850f6c04d752d339df3939b20a92 /sql/item_cmpfunc.h | |
| parent | 29eac312cda3bebddeb7f5ab7a2af6b81ea89205 (diff) | |
| download | mariadb-git-cb06e0c1250074337293289e4914f01911e68ec5.tar.gz | |
Fix bug #15268 Unchecked null value caused server crash
cmp_item_sort_string::cmp() wasn't checking values_res variable for null.
Later called function was dereferenced it and crashed server.
Added null check to cmp_item_sort_string::cmp().
sql/item_cmpfunc.h:
Fix bug#15268 Unchecked null value caused server crash
Added null check to cmp_item_sort_string::cmp().
mysql-test/t/select.test:
Test case for bug#15268 Unchecked null value caused server crash
mysql-test/r/select.result:
Test case for bug#15268 Unchecked null value caused server crash
Diffstat (limited to 'sql/item_cmpfunc.h')
| -rw-r--r-- | sql/item_cmpfunc.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sql/item_cmpfunc.h b/sql/item_cmpfunc.h index bfd32223d4c..b4064fb45b8 100644 --- a/sql/item_cmpfunc.h +++ b/sql/item_cmpfunc.h @@ -723,9 +723,9 @@ public: { char buff[STRING_BUFFER_USUAL_SIZE]; String tmp(buff, sizeof(buff), cmp_charset), *res; - if (!(res= arg->val_str(&tmp))) - return 1; /* Can't be right */ - return sortcmp(value_res, res, cmp_charset); + res= arg->val_str(&tmp); + return (value_res ? (res ? sortcmp(value_res, res, cmp_charset) : 1) : + (res ? -1 : 0)); } int compare(cmp_item *c) { |