diff options
| author | unknown <evgen@moonbone.local> | 2007-01-19 18:34:09 +0300 |
|---|---|---|
| committer | unknown <evgen@moonbone.local> | 2007-01-19 18:34:09 +0300 |
| commit | 5effa05d3f31971461da851f0650951e1e488421 (patch) | |
| tree | 2261174445362ee68b36085a334b263371a58648 /sql/sql_update.cc | |
| parent | 759a028c20412d26802d479724de932a288a3e43 (diff) | |
| download | mariadb-git-5effa05d3f31971461da851f0650951e1e488421.tar.gz | |
Bug#25172: Not checked buffer size leads to a server crash.
After fix for bug#21798 JOIN stores the pointer to the buffer for sorting
fields. It is used while sorting for grouping and for ordering. If ORDER BY
clause has more elements then the GROUP BY clause then a memory overrun occurs.
Now the length of the ORDER BY list is always passed to the
make_unireg_sortorder() function and it allocates buffer big enough to be
used for bigger list.
sql/sql_delete.cc:
Bug#25172: Not checked buffer size leads to a server crash.
Length parameter is initialized to 0 for the make_unireg_sortorder() function.
sql/sql_select.cc:
Bug#25172: Not checked buffer size leads to a server crash.
Now the length of the ORDER BY list is always passed to the
make_unireg_sortorder() function and it allocates buffer big enough to be
used for bigger list.
sql/sql_table.cc:
Bug#25172: Not checked buffer size leads to a server crash.
Length parameter is initialized to 0 for the make_unireg_sortorder() function.
sql/sql_update.cc:
Bug#25172: Not checked buffer size leads to a server crash.
Length parameter is initialized to 0 for the make_unireg_sortorder() function.
mysql-test/r/select.result:
Added a test case for bug#25172: Not checked buffer size leads to a server crash.
mysql-test/t/select.test:
Added a test case for bug#25172: Not checked buffer size leads to a server crash.
Diffstat (limited to 'sql/sql_update.cc')
| -rw-r--r-- | sql/sql_update.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/sql_update.cc b/sql/sql_update.cc index abffd704188..76d4847f923 100644 --- a/sql/sql_update.cc +++ b/sql/sql_update.cc @@ -304,7 +304,7 @@ int mysql_update(THD *thd, Doing an ORDER BY; Let filesort find and sort the rows we are going to update */ - uint length; + uint length= 0; SORT_FIELD *sortorder; ha_rows examined_rows; |