diff options
| author | Alexander Barkov <bar@mysql.com> | 2010-11-11 13:31:17 +0300 |
|---|---|---|
| committer | Alexander Barkov <bar@mysql.com> | 2010-11-11 13:31:17 +0300 |
| commit | 324cb4589943e37907e4de70c1eaa8cf0cb05737 (patch) | |
| tree | 72af241003ca0446fc03f8477a0931aba15f6eb7 /sql/item_strfunc.cc | |
| parent | 0c4e115c952c8c6a429c81d844b5767cd80ad479 (diff) | |
| parent | 771137b50e9ae9a5fcbb8d2665f985d394434036 (diff) | |
| download | mariadb-git-324cb4589943e37907e4de70c1eaa8cf0cb05737.tar.gz | |
Merging from mysql-5.1-security
Diffstat (limited to 'sql/item_strfunc.cc')
| -rw-r--r-- | sql/item_strfunc.cc | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index 6d8a113d4a4..c71d8226f77 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -1080,9 +1080,15 @@ String *Item_func_replace::val_str(String *str) search=res2->ptr(); search_end=search+from_length; redo: + DBUG_ASSERT(res->ptr() || !offset); ptr=res->ptr()+offset; strend=res->ptr()+res->length(); - end=strend-from_length+1; + /* + In some cases val_str() can return empty string + with ptr() == NULL and length() == 0. + Let's check strend to avoid overflow. + */ + end= strend ? strend - from_length + 1 : NULL; while (ptr < end) { if (*ptr == *search) |