diff options
| author | Guilhem Bichot <guilhem@mysql.com> | 2009-08-12 15:44:34 +0200 |
|---|---|---|
| committer | Guilhem Bichot <guilhem@mysql.com> | 2009-08-12 15:44:34 +0200 |
| commit | 8d1fdf09bb39663e8aad2a01f7ece81924e1f5a1 (patch) | |
| tree | 5fdae14ec96fd61b574fe1c8b2d62d304114c53c /sql/net_serv.cc | |
| parent | a39de6353abfb787723a61479fb20a942622a160 (diff) | |
| parent | cea2f8b6303b07906ab710b36c0c292a7865f52f (diff) | |
| download | mariadb-git-8d1fdf09bb39663e8aad2a01f7ece81924e1f5a1.tar.gz | |
merge of 5.1-main into mysql-trunk.
Changes to ha_innodb.cc are not propagated to plugin, they will come back
via Oracle/Innobase if needed.
Diffstat (limited to 'sql/net_serv.cc')
| -rw-r--r-- | sql/net_serv.cc | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/sql/net_serv.cc b/sql/net_serv.cc index 8ee819bcbda..7ff26c50afc 100644 --- a/sql/net_serv.cc +++ b/sql/net_serv.cc @@ -187,10 +187,12 @@ my_bool net_realloc(NET *net, size_t length) pkt_length = (length+IO_SIZE-1) & ~(IO_SIZE-1); /* We must allocate some extra bytes for the end 0 and to be able to - read big compressed blocks + read big compressed blocks + 1 safety byte since uint3korr() in + my_real_read() may actually read 4 bytes depending on build flags and + platform. */ if (!(buff= (uchar*) my_realloc((char*) net->buff, pkt_length + - NET_HEADER_SIZE + COMP_HEADER_SIZE, + NET_HEADER_SIZE + COMP_HEADER_SIZE + 1, MYF(MY_WME)))) { /* @todo: 1 and 2 codes are identical. */ @@ -943,6 +945,13 @@ my_real_read(NET *net, size_t *complen) #ifdef HAVE_COMPRESS if (net->compress) { + /* + The following uint3korr() may read 4 bytes, so make sure we don't + read unallocated or uninitialized memory. The right-hand expression + must match the size of the buffer allocated in net_realloc(). + */ + DBUG_ASSERT(net->where_b + NET_HEADER_SIZE + sizeof(uint32) <= + net->max_packet + NET_HEADER_SIZE + COMP_HEADER_SIZE + 1); /* If the packet is compressed then complen > 0 and contains the number of bytes in the uncompressed packet |