diff options
| author | unknown <timour@askmonty.org> | 2012-11-09 10:11:20 +0200 |
|---|---|---|
| committer | unknown <timour@askmonty.org> | 2012-11-09 10:11:20 +0200 |
| commit | 3f590335363dec43e301fac174f9349233f5804c (patch) | |
| tree | 4c3b3e4f9f71cf31cc18cf7d0ba48a3ef3b5c2d3 /sql/spatial.cc | |
| parent | 94cae65774194f8769b18e6943713d1fed5f89fa (diff) | |
| parent | 8df490044cf6fd4a7bcb38cab509975b39b1216d (diff) | |
| download | mariadb-git-3f590335363dec43e301fac174f9349233f5804c.tar.gz | |
Merge MariaDB 5.1.66 -> 5.2 -> 5.3
Diffstat (limited to 'sql/spatial.cc')
| -rw-r--r-- | sql/spatial.cc | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sql/spatial.cc b/sql/spatial.cc index 44c5ea411b7..0da2fdf40b3 100644 --- a/sql/spatial.cc +++ b/sql/spatial.cc @@ -597,7 +597,8 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len, Gis_point p; if (len < 4 || - (n_points= wkb_get_uint(wkb, bo))<1) + (n_points= wkb_get_uint(wkb, bo)) < 1 || + n_points > max_n_points) return 0; proper_length= 4 + n_points * POINT_DATA_SIZE; @@ -1331,9 +1332,9 @@ uint Gis_multi_point::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo, Gis_point p; const char *wkb_end; - if (len < 4) + if (len < 4 || + (n_points= wkb_get_uint(wkb, bo)) > max_n_points) return 0; - n_points= wkb_get_uint(wkb, bo); proper_size= 4 + n_points * (WKB_HEADER_SIZE + POINT_DATA_SIZE); if (len < proper_size || res->reserve(proper_size)) |