Bug#55531 crash with conversions of geometry types / strings

Convertion from a floating point number to a string caused a
crash.

During rare circumstances a String object could crash when
it was requested to allocate new memory.
A crash could occcur in Field_double::val_str() because of
a pointer referencing memory inside a String object which was
of unknown size.
And finally, the geometric collection should not accept
arguments which are non geometric.

1 files changed, 13 insertions, 0 deletions

diff --git a/sql/item_geofunc.h b/sql/item_geofunc.h
index edbe104e307..070c2cd26fc 100644
--- a/sql/item_geofunc.h
+++ b/sql/item_geofunc.h
@@ -175,6 +175,19 @@ public:
     item_type=it;
   }
   String *val_str(String *);
+  void fix_length_and_dec()
+  {
+    for( unsigned int i=0; i<arg_count; ++i)
+    {
+      if( args[i]->fixed && args[i]->field_type() != MYSQL_TYPE_GEOMETRY)
+      {
+        String str;
+        args[i]->val_str(&str);
+        my_error(ER_ILLEGAL_VALUE_FOR_TYPE,MYF(0),"non geometric",str.c_ptr());
+      }
+    }
+  }
+ 
   const char *func_name() const { return "multipoint"; }
 };