A fix (bug #5497: COMPRESS() returns NULL for large strings).

1 files changed, 9 insertions, 3 deletions

diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index fac73a1a759..cf2fe137d05 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -2723,11 +2723,17 @@ String *Item_func_compress::val_str(String *str)
    compress(compress(compress(...)))
    I.e. zlib give number 'at least'..
   */
-  ulong new_size= (ulong)((res->length()*120)/100)+12;
+  ulong new_size= res->length() + res->length() / 5 + 12;
 
-  buffer.realloc((uint32)new_size + 4 + 1);
-  Byte *body= ((Byte*)buffer.ptr()) + 4;
+  // Will check new_size overflow: new_size <= res->length()
+  if (((uint32) new_size <= res->length()) || 
+      buffer.realloc((uint32) new_size + 4 + 1))
+  {
+    null_value= 1;
+    return 0;
+  }
 
+  Byte *body= ((Byte*)buffer.ptr()) + 4;
 
   // As far as we have checked res->is_empty() we can use ptr()
   if ((err= compress(body, &new_size,