diff options
| author | Michael Widenius <monty@askmonty.org> | 2011-03-09 15:47:59 +0200 |
|---|---|---|
| committer | Michael Widenius <monty@askmonty.org> | 2011-03-09 15:47:59 +0200 |
| commit | 139a2b64bf8ec2e248656835e23a5c98ffc667a8 (patch) | |
| tree | 7d77d6f1073f8090f275b30cb3f10254497da243 /sql/item_strfunc.cc | |
| parent | b3f7eac5301529c2d069ebe4d0558980412af3a2 (diff) | |
| parent | ce675406ca8dbc1532a908803a1371de8432d466 (diff) | |
| download | mariadb-git-139a2b64bf8ec2e248656835e23a5c98ffc667a8.tar.gz | |
Merge with 5.2
Diffstat (limited to 'sql/item_strfunc.cc')
| -rw-r--r-- | sql/item_strfunc.cc | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc index aebbc21b0fc..ad88fe31a0d 100644 --- a/sql/item_strfunc.cc +++ b/sql/item_strfunc.cc @@ -905,9 +905,15 @@ String *Item_func_replace::val_str(String *str) search=res2->ptr(); search_end=search+from_length; redo: + DBUG_ASSERT(res->ptr() || !offset); ptr=res->ptr()+offset; strend=res->ptr()+res->length(); - end=strend-from_length+1; + /* + In some cases val_str() can return empty string + with ptr() == NULL and length() == 0. + Let's check strend to avoid overflow. + */ + end= strend ? strend - from_length + 1 : NULL; while (ptr < end) { if (*ptr == *search) |