Bug #30587: mysql crashes when trying to group by TIME div NUMBER

When calculating the result length of an integer DIV function 
the number of decimals was used without checking the result type
first. Thus an uninitialized number of decimals was used for some 
types. This caused an excessive amount of memory to be allocated 
for the field's buffer and crashed the server.

 
Fixed by using the number of decimals only for data types that 
can have decimals and thus have valid decimals number.

1 files changed, 5 insertions, 1 deletions

diff --git a/sql/item_func.cc b/sql/item_func.cc
index d03d497dfd0..a90cc721ca9 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -1380,7 +1380,11 @@ longlong Item_func_int_div::val_int()
 
 void Item_func_int_div::fix_length_and_dec()
 {
-  max_length=args[0]->max_length - args[0]->decimals;
+  Item_result argtype= args[0]->result_type();
+  /* use precision ony for the data type it is applicable for and valid */
+  max_length=args[0]->max_length -
+    (argtype == DECIMAL_RESULT || argtype == INT_RESULT ?
+     args[0]->decimals : 0);
   maybe_null=1;
   unsigned_flag=args[0]->unsigned_flag | args[1]->unsigned_flag;
 }