Bug#27898 UPDATEXML Crashes the Server!

Problem: when replacing the root element, UpdateXML
erroneously tried to mix old XML content with the
replacement string, which led to crash.
Fix: don't use the old XML content in these cases,
just return the replacement string.

1 files changed, 10 insertions, 0 deletions

diff --git a/sql/item_xmlfunc.cc b/sql/item_xmlfunc.cc
index 26474990644..d29738429b7 100644
--- a/sql/item_xmlfunc.cc
+++ b/sql/item_xmlfunc.cc
@@ -2768,6 +2768,16 @@ String *Item_func_xml_update::val_str(String *str)
 
   nodebeg+= fltbeg->num;
 
+  if (!nodebeg->level)
+  {
+    /*
+      Root element, without NameTest:
+      UpdateXML(xml, '/', 'replacement');
+      Just return the replacement string.
+    */
+    return rep;
+  }
+
   tmp_value.length(0);
   tmp_value.set_charset(collation.collation);
   uint offs= nodebeg->type == MY_XML_NODE_TAG ? 1 : 0;