diff options
| author | unknown <timour@askmonty.org> | 2012-11-06 11:52:55 +0200 |
|---|---|---|
| committer | unknown <timour@askmonty.org> | 2012-11-06 11:52:55 +0200 |
| commit | 7c23d6d0c66cb3b84cb466f956e19bfea0acc342 (patch) | |
| tree | 551dd23a43a26923a6dd30096a2822a27a90f355 /sql/spatial.cc | |
| parent | 43293b7a515dbb2cf04907e2d98bcc813279cad8 (diff) | |
| parent | 813b661d00123e3291530d102e2b94388f42fb0f (diff) | |
| download | mariadb-git-7c23d6d0c66cb3b84cb466f956e19bfea0acc342.tar.gz | |
Merge MySQL 5.1.66 -> MariaDB 5.1.65
Diffstat (limited to 'sql/spatial.cc')
| -rw-r--r-- | sql/spatial.cc | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/sql/spatial.cc b/sql/spatial.cc index 783d37ada48..eec028eaef1 100644 --- a/sql/spatial.cc +++ b/sql/spatial.cc @@ -525,12 +525,13 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len, const char *wkb_end; Gis_point p; - if (len < 4) + if (len < 4 || + (n_points= wkb_get_uint(wkb, bo)) < 1 || + n_points > max_n_points) return 0; - n_points= wkb_get_uint(wkb, bo); proper_length= 4 + n_points * POINT_DATA_SIZE; - if (!n_points || len < proper_length || res->reserve(proper_length)) + if (len < proper_length || res->reserve(proper_length)) return 0; res->q_append(n_points); @@ -1072,9 +1073,9 @@ uint Gis_multi_point::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo, Gis_point p; const char *wkb_end; - if (len < 4) + if (len < 4 || + (n_points= wkb_get_uint(wkb, bo)) > max_n_points) return 0; - n_points= wkb_get_uint(wkb, bo); proper_size= 4 + n_points * (WKB_HEADER_SIZE + POINT_DATA_SIZE); if (len < proper_size || res->reserve(proper_size)) |