Bug#15776: 32-bit signed int used for length of blob

Based on contributed patch from Martin Friebe, CLA from 2007-02-24.

The parser lacked support for field sizes after signed long,
when it should extend to 2**32-1.

Now, we correct that limitation, and also make the error handling
consistent for casts.


mysql-test/r/type_blob.result:
  Verify that blobs may be created with the size that is already
  documented.
  
  Additionally, test the limits of several other types.
mysql-test/t/type_blob.test:
  Verify that blobs may be created with the size that is already
  documented.
  
  Additionally, test the limits of several other types.
sql/field.cc:
  atoi() insufficient to gauge the length of some fields.  Change
  it to strtoul().
sql/item_create.cc:
  atoi() insufficient to gauge the length of some fields.  Change
  it to strtoul().
  
  If a casted length is too long, raise an error.
sql/share/errmsg.txt:
  Change ER_TOO_BIG_FIELDLENGTH so that it can accept sizes larger
  than 2**15 -- instead, 2**32.
sql/sql_yacc.yy:
  Make lengths take, in addition to NUM, LONG_NUM, ULONGLONG_NUM,
  and DECIMAL_NUM.
sql/unireg.h:
  Define new constant.

1 files changed, 54 insertions, 3 deletions

diff --git a/sql/item_create.cc b/sql/item_create.cc
index 561613032bc..b7a9a1d7feb 100644
--- a/sql/item_create.cc
+++ b/sql/item_create.cc
@@ -464,8 +464,42 @@ Item *create_func_cast(Item *a, Cast_target cast_type,
   case ITEM_CAST_TIME:		res= new Item_time_typecast(a); break;
   case ITEM_CAST_DATETIME:	res= new Item_datetime_typecast(a); break;
   case ITEM_CAST_DECIMAL:
-    len= c_len ? atoi(c_len) : 0;
-    dec= c_dec ? atoi(c_dec) : 0;
+    if (c_len == NULL)
+    {
+      len= 0;
+    }
+    else
+    {
+      ulong decoded_size;
+      errno= 0;
+      decoded_size= strtoul(c_len, NULL, 10);
+      if (errno != 0)
+      {
+        my_error(ER_TOO_BIG_PRECISION, MYF(0), c_len, a->name,
+                 DECIMAL_MAX_PRECISION);
+        return NULL;
+      }
+      len= decoded_size;
+    }
+
+    if (c_dec == NULL)
+    {
+      dec= 0;
+    }
+    else
+    {
+      ulong decoded_size;
+      errno= 0;
+      decoded_size= strtoul(c_dec, NULL, 10);
+      if ((errno != 0) || (decoded_size > UINT_MAX))
+      {
+        my_error(ER_TOO_BIG_SCALE, MYF(0), c_dec, a->name,
+                 DECIMAL_MAX_SCALE);
+        return NULL;
+      }
+      dec= decoded_size;
+    }
+
     my_decimal_trim(&len, &dec);
     if (len < dec)
     {
@@ -486,8 +520,25 @@ Item *create_func_cast(Item *a, Cast_target cast_type,
     }
     res= new Item_decimal_typecast(a, len, dec);
     break;
+
   case ITEM_CAST_CHAR:
-    len= c_len ? atoi(c_len) : -1;
+    if (c_len == NULL)
+    {
+      len= LL(-1);
+    }
+    else
+    {
+      ulong decoded_size;
+      errno= 0;
+      decoded_size= strtoul(c_len, NULL, 10);
+      if (errno != 0)
+      {
+        my_error(ER_TOO_BIG_DISPLAYWIDTH, MYF(0), "cast as char", MAX_FIELD_BLOBLENGTH);
+        return NULL;
+      }
+      len= decoded_size;
+    }
+
     res= new Item_char_typecast(a, len, cs ? cs : 
 				current_thd->variables.collation_connection);
     break;