diff options
| author | Magne Mahre <magne.mahre@sun.com> | 2009-10-15 13:38:21 +0200 |
|---|---|---|
| committer | Magne Mahre <magne.mahre@sun.com> | 2009-10-15 13:38:21 +0200 |
| commit | 7e895de84f257b3cf143fd87f0f206c1504e6292 (patch) | |
| tree | 5b994fd928531d5dc5e3b80f46bb1f58b03e7c4c /sql/set_var.cc | |
| parent | 53d549483b9f34c46a26aace15c4db75fe81b9a8 (diff) | |
| download | mariadb-git-7e895de84f257b3cf143fd87f0f206c1504e6292.tar.gz | |
Bug #38124 (clean-up patch)
The fix for Bug #38124 introuced a bug. If the value given
for a set_var exceeded the length of the temporary buffer,
we would read behind the end of the buffer. Using
c_ptr_safe(), instead of c_ptr(), ensures that we won't
read beyond the buffer limit
mysql-6.0-codebase revid: 2617.44.1
Diffstat (limited to 'sql/set_var.cc')
| -rw-r--r-- | sql/set_var.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/set_var.cc b/sql/set_var.cc index d9e324e3811..1a0f63f3d4f 100644 --- a/sql/set_var.cc +++ b/sql/set_var.cc @@ -2544,7 +2544,7 @@ bool update_sys_var_str_path(THD *thd, sys_var_str *var_str, String str(buff, sizeof(buff), system_charset_info), *newval; newval= var->value->val_str(&str); - old_value= newval->c_ptr(); + old_value= newval->c_ptr_safe(); str_length= strlen(old_value); } |