summaryrefslogtreecommitdiff
path: root/sql
diff options
context:
space:
mode:
authorAlexey Botchkov <holyfoot@askmonty.org>2014-02-18 17:15:25 +0400
committerAlexey Botchkov <holyfoot@askmonty.org>2014-02-18 17:15:25 +0400
commit820b1a66870639951cdf7f1cbfef14c3ba889615 (patch)
tree6805bf0739b460beab3dd0da1d06565b92138e40 /sql
parentccb54beb6dca11bc4cc438c00366acf35b35f815 (diff)
downloadmariadb-git-820b1a66870639951cdf7f1cbfef14c3ba889615.tar.gz
MDEV-5615 crash in Gcalc_function::add_operation.
The result is EMPTY for a buffer(line, -1), but we still need one FALSE operation to be stored in the condition. And we actually add it but forgot to alloc memory to store it.
Diffstat (limited to 'sql')
-rw-r--r--sql/item_geofunc.cc6
-rw-r--r--sql/spatial.cc3
2 files changed, 6 insertions, 3 deletions
diff --git a/sql/item_geofunc.cc b/sql/item_geofunc.cc
index 211140c029b..d8612abb59c 100644
--- a/sql/item_geofunc.cc
+++ b/sql/item_geofunc.cc
@@ -857,7 +857,7 @@ String *Item_func_spatial_operation::val_str(String *str_value)
str_value->length(0);
str_value->q_append(srid);
- if (!Geometry::create_from_opresult(&buffer1, str_value, res_receiver))
+ if (Geometry::create_from_opresult(&buffer1, str_value, res_receiver))
goto exit;
exit:
@@ -1114,6 +1114,8 @@ int Item_func_buffer::Transporter::start_line()
{
if (buffer_op == Gcalc_function::op_difference)
{
+ if (m_fn->reserve_op_buffer(1))
+ return 1;
m_fn->add_operation(Gcalc_function::op_false, 0);
skip_line= TRUE;
return 0;
@@ -1315,7 +1317,7 @@ String *Item_func_buffer::val_str(String *str_value)
str_value->length(0);
str_value->q_append(srid);
- if (!Geometry::create_from_opresult(&buffer, str_value, res_receiver))
+ if (Geometry::create_from_opresult(&buffer, str_value, res_receiver))
goto mem_error;
null_value= 0;
diff --git a/sql/spatial.cc b/sql/spatial.cc
index 8f74d4fa4a7..551c79d4d90 100644
--- a/sql/spatial.cc
+++ b/sql/spatial.cc
@@ -298,7 +298,8 @@ int Geometry::create_from_opresult(Geometry_buffer *g_buf,
res->q_append((char) wkb_ndr);
res->q_append(geom_type);
- return obj->init_from_opresult(res, rr.result(), rr.length());
+ return obj->init_from_opresult(res, rr.result(), rr.length()) == 0 &&
+ rr.length();
}