diff options
| author | msvensson@neptunus.(none) <> | 2006-08-01 20:24:30 +0200 |
|---|---|---|
| committer | msvensson@neptunus.(none) <> | 2006-08-01 20:24:30 +0200 |
| commit | 31be565d2ed48ebc2d4bc57d0896b8750810527b (patch) | |
| tree | 846b441c9730546494aa063e2bc4f74751efde48 /sql/item_strfunc.cc | |
| parent | d8d17559eee16aa2f40159711f1b7967b79c5b6a (diff) | |
| parent | 09a36146b85ec542a93e6d47bc645470d1ca30d3 (diff) | |
| download | mariadb-git-31be565d2ed48ebc2d4bc57d0896b8750810527b.tar.gz | |
Merge neptunus.(none):/home/msvensson/mysql/mysql-5.0
into neptunus.(none):/home/msvensson/mysql/mysql-5.0-maint
Diffstat (limited to 'sql/item_strfunc.cc')
| -rw-r--r-- | sql/item_strfunc.cc | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index 5ceb462385c..c63a89351c6 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -2968,6 +2968,16 @@ String *Item_func_uncompress::val_str(String *str) if (res->is_empty()) return res; + /* If length is less than 4 bytes, data is corrupt */ + if (res->length() <= 4) + { + push_warning_printf(current_thd,MYSQL_ERROR::WARN_LEVEL_ERROR, + ER_ZLIB_Z_DATA_ERROR, + ER(ER_ZLIB_Z_DATA_ERROR)); + goto err; + } + + /* Size of uncompressed data is stored as first 4 bytes of field */ new_size= uint4korr(res->ptr()) & 0x3FFFFFFF; if (new_size > current_thd->variables.max_allowed_packet) { |