diff options
| author | Alexander Barkov <bar@mysql.com> | 2010-11-11 13:25:23 +0300 |
|---|---|---|
| committer | Alexander Barkov <bar@mysql.com> | 2010-11-11 13:25:23 +0300 |
| commit | aa668865e271694e9b3ebbfe518cb4d0c2ad0c38 (patch) | |
| tree | c6f7021e2960150a80f50095d0a6d53262e74c33 /sql/item_xmlfunc.cc | |
| parent | 9f71cfc0a965b581c1aa1744d3e092f6f1493a49 (diff) | |
| download | mariadb-git-aa668865e271694e9b3ebbfe518cb4d0c2ad0c38.tar.gz | |
Bug#57257 Replace(ExtractValue(...)) causes MySQL crash
Bug#57820 extractvalue crashes
Problem: ExtractValue and Replace crashed in some cases
due to invalid handling of empty and NULL arguments.
Per file comments:
@mysql-test/r/ctype_ujis.result
@mysql-test/r/xml.result
@mysql-test/t/ctype_ujis.test
@mysql-test/t/xml.test
Adding tests
@sql/item_strfunc.cc
Make sure Item_func_replace::val_str safely handles empty strings.
@sql/item_xmlfunc.cc
set null_value if nodeset_func returned NULL,
which is possible when the second argument is an
unset user variable.
Diffstat (limited to 'sql/item_xmlfunc.cc')
| -rw-r--r-- | sql/item_xmlfunc.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sql/item_xmlfunc.cc b/sql/item_xmlfunc.cc index 3e20b90e68e..364311877e0 100644 --- a/sql/item_xmlfunc.cc +++ b/sql/item_xmlfunc.cc @@ -2790,12 +2790,12 @@ String *Item_func_xml_extractvalue::val_str(String *str) null_value= 0; if (!nodeset_func || !(res= args[0]->val_str(str)) || - !parse_xml(res, &pxml)) + !parse_xml(res, &pxml) || + !(res= nodeset_func->val_str(&tmp_value))) { null_value= 1; return 0; } - res= nodeset_func->val_str(&tmp_value); return res; } |