diff options
| author | Sergei Golubchik <serg@mariadb.org> | 2017-01-16 18:47:53 +0100 |
|---|---|---|
| committer | Sergei Golubchik <serg@mariadb.org> | 2017-01-17 20:16:16 +0100 |
| commit | f797ea7124e906fd3abf311d66101a21dce2d27d (patch) | |
| tree | 568ec59cfc215d2fc25ea38b4d94f20c7ca4f68d /sql | |
| parent | ef8003eb9a23007ac5d606530dcdcc3ea2f0c039 (diff) | |
| download | mariadb-git-f797ea7124e906fd3abf311d66101a21dce2d27d.tar.gz | |
MDEV-11601 Out-of-bounds string access in create_schema_table()
in Item_partition_func_safe_string(THD *thd, const char *name_arg,
uint length, CHARSET_INFO *cs= NULL), the 'name_arg' is the value
of the string constant and 'length' is the length of this constant,
so length == strlen(name_arg).
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/item.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/item.h b/sql/item.h index 07b8a865652..b09e9297826 100644 --- a/sql/item.h +++ b/sql/item.h @@ -3206,7 +3206,7 @@ class Item_blob :public Item_partition_func_safe_string { public: Item_blob(THD *thd, const char *name_arg, uint length): - Item_partition_func_safe_string(thd, name_arg, length, &my_charset_bin) + Item_partition_func_safe_string(thd, name_arg, strlen(name_arg), &my_charset_bin) { max_length= length; } enum Type type() const { return TYPE_HOLDER; } enum_field_types field_type() const { return MYSQL_TYPE_BLOB; } |