MDEV-12705 10.1.18-MariaDB-1~jessie - mysqld got signal 11.

        Space for the next operation wasn't reserved in
        Item_func_spatial_relate::val_str()

1 files changed, 8 insertions, 2 deletions

diff --git a/sql/item_geofunc.cc b/sql/item_geofunc.cc
index fd7241b7bc3..51a4636df1f 100644
--- a/sql/item_geofunc.cc
+++ b/sql/item_geofunc.cc
@@ -1194,6 +1194,8 @@ static int setup_relate_func(Geometry *g1, Geometry *g2,
     }
     else
       func->repeat_expression(shape_a);
+    if (func->reserve_op_buffer(1))
+      return 1;
     func->add_operation(op_matrix(nc%3), 1);
     if (do_store_shapes)
     {
@@ -1364,11 +1366,13 @@ longlong Item_func_spatial_precise_rel::val_int()
                          Gcalc_function::op_intersection, 2);
       func.add_operation(Gcalc_function::op_internals, 1);
       shape_a= func.get_next_expression_pos();
-      if ((null_value= g1.store_shapes(&trn)))
+      if ((null_value= g1.store_shapes(&trn)) ||
+          func.reserve_op_buffer(1))
         break;
       func.add_operation(Gcalc_function::op_internals, 1);
       shape_b= func.get_next_expression_pos();
-      if ((null_value= g2.store_shapes(&trn)))
+      if ((null_value= g2.store_shapes(&trn)) ||
+          func.reserve_op_buffer(1))
         break;
       func.add_operation(Gcalc_function::v_find_t |
                          Gcalc_function::op_intersection, 2);
@@ -1603,6 +1607,8 @@ int Item_func_buffer::Transporter::single_point(double x, double y)
 {
   if (buffer_op == Gcalc_function::op_difference)
   {
+    if (m_fn->reserve_op_buffer(1))
+      return 1;
     m_fn->add_operation(Gcalc_function::op_false, 0);
     return 0;
   }