diff options
| author | Ramil Kalimullin <ramil@mysql.com> | 2010-04-29 08:54:09 +0400 |
|---|---|---|
| committer | Ramil Kalimullin <ramil@mysql.com> | 2010-04-29 08:54:09 +0400 |
| commit | 2303a8c6e4dd94eb6b682c61e0ff333c21b188b2 (patch) | |
| tree | 022184ebc96f4a384cb418828054188acf49c58a /sql/sql_parse.cc | |
| parent | 4d0e9957acdddf7a07e095ef2e8f53a2cb99b24b (diff) | |
| parent | 0d5dbb166b1bcd39588268d4148f02c9f58575f8 (diff) | |
| download | mariadb-git-2303a8c6e4dd94eb6b682c61e0ff333c21b188b2.tar.gz | |
Manual merge.
Diffstat (limited to 'sql/sql_parse.cc')
| -rw-r--r-- | sql/sql_parse.cc | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc index 5228a37f490..11481933c8a 100644 --- a/sql/sql_parse.cc +++ b/sql/sql_parse.cc @@ -1300,8 +1300,16 @@ bool dispatch_command(enum enum_server_command command, THD *thd, We have name + wildcard in packet, separated by endzero */ arg_end= strend(packet); + uint arg_length= arg_end - packet; + + /* Check given table name length. */ + if (arg_length >= packet_length || arg_length > NAME_LEN) + { + my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0)); + break; + } thd->convert_string(&conv_name, system_charset_info, - packet, (uint) (arg_end - packet), thd->charset()); + packet, arg_length, thd->charset()); table_list.alias= table_list.table_name= conv_name.str; packet= arg_end + 1; |