diff options
| author | Alexey Botchkov <holyfoot@askmonty.org> | 2013-03-19 17:25:58 +0400 |
|---|---|---|
| committer | Alexey Botchkov <holyfoot@askmonty.org> | 2013-03-19 17:25:58 +0400 |
| commit | ef737284b416292d21837d7dedbffe66a4b4b8d4 (patch) | |
| tree | c77400e611abf248540eef6fb67772b2c8c8a653 /sql/spatial.cc | |
| parent | 15a7335d77d056e860a9fdc844343c840e310e68 (diff) | |
| download | mariadb-git-ef737284b416292d21837d7dedbffe66a4b4b8d4.tar.gz | |
MDEV-4295 Server crashes in get_point on a query with Area, AsBinary, MultiPoint.
Need to check if the number of points is 0 for the polygon.
Diffstat (limited to 'sql/spatial.cc')
| -rw-r--r-- | sql/spatial.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sql/spatial.cc b/sql/spatial.cc index afaa67763e8..52110960f96 100644 --- a/sql/spatial.cc +++ b/sql/spatial.cc @@ -868,7 +868,7 @@ int Gis_polygon::area(double *ar, const char **end_of_data) const if (no_data(data, 4)) return 1; n_points= uint4korr(data); - if (n_points > max_n_points || + if (n_points == 0 || n_points > max_n_points || no_data(data, (SIZEOF_STORED_DOUBLE*2) * n_points)) return 1; get_point(&prev_x, &prev_y, data+4); @@ -989,7 +989,7 @@ int Gis_polygon::centroid_xy(double *x, double *y) const return 1; org_n_points= n_points= uint4korr(data); data+= 4; - if (n_points > max_n_points || + if (n_points == 0 || n_points > max_n_points || no_data(data, (SIZEOF_STORED_DOUBLE*2) * n_points)) return 1; get_point(&prev_x, &prev_y, data); |