diff options
| author | Luis Soares <luis.soares@sun.com> | 2010-03-25 00:30:16 +0000 |
|---|---|---|
| committer | Luis Soares <luis.soares@sun.com> | 2010-03-25 00:30:16 +0000 |
| commit | a086b2b0d352ad83c2b7adbbdfc5d22ba01334bd (patch) | |
| tree | 3eda5de62ec0b4e2b297db78702bcef792256d34 /sql | |
| parent | 5937da69a6d5b3461373dfc7abd8d003f4013fce (diff) | |
| download | mariadb-git-a086b2b0d352ad83c2b7adbbdfc5d22ba01334bd.tar.gz | |
BUG#52202: mysqlbinlog_row* fail in daily-trunk on Sol10 x86_64
debug_max
There was a buffer overrun when unpacking the date
field. Incidentaly, this seems to affect only solaris x86_64
debug builds, but others platforms may be vulnerable as well.
In particular, the buffer size used was not taking into
consideration that the '\0' character would be written into
it.
We fix this by increasing the size of the buffer used to
accommodate one extra byte (the one for the '\0').
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/log_event.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sql/log_event.cc b/sql/log_event.cc index 6412f0047d1..f23e30f2024 100644 --- a/sql/log_event.cc +++ b/sql/log_event.cc @@ -1717,8 +1717,8 @@ log_event_print_value(IO_CACHE *file, const uchar *ptr, { uint32 tmp= uint3korr(ptr); int part; - char buf[10]; - char *pos= &buf[10]; + char buf[11]; + char *pos= &buf[10]; // start from '\0' to the beginning /* Copied from field.cc */ *pos--=0; // End NULL |