diff options
| author | Alexey Kopytov <Alexey.Kopytov@Sun.com> | 2009-07-28 23:14:24 +0400 |
|---|---|---|
| committer | Alexey Kopytov <Alexey.Kopytov@Sun.com> | 2009-07-28 23:14:24 +0400 |
| commit | fd3b0066f9b34c245b4f1ef743b59d18270ccf6c (patch) | |
| tree | 0255674bba8634aa0a25573e984796db8b115158 /sql | |
| parent | f8158fb5d2a6957d12f356e267ce7bf02162da3c (diff) | |
| parent | f9437bd769ce680c94defcd1cb0710a18e31b5ec (diff) | |
| download | mariadb-git-fd3b0066f9b34c245b4f1ef743b59d18270ccf6c.tar.gz | |
Automerge.
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/net_serv.cc | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/sql/net_serv.cc b/sql/net_serv.cc index 0a8720bae64..73892f31ccf 100644 --- a/sql/net_serv.cc +++ b/sql/net_serv.cc @@ -186,10 +186,12 @@ my_bool net_realloc(NET *net, size_t length) pkt_length = (length+IO_SIZE-1) & ~(IO_SIZE-1); /* We must allocate some extra bytes for the end 0 and to be able to - read big compressed blocks + read big compressed blocks + 1 safety byte since uint3korr() in + my_real_read() may actually read 4 bytes depending on build flags and + platform. */ if (!(buff= (uchar*) my_realloc((char*) net->buff, pkt_length + - NET_HEADER_SIZE + COMP_HEADER_SIZE, + NET_HEADER_SIZE + COMP_HEADER_SIZE + 1, MYF(MY_WME)))) { /* @todo: 1 and 2 codes are identical. */ @@ -921,6 +923,13 @@ my_real_read(NET *net, size_t *complen) #ifdef HAVE_COMPRESS if (net->compress) { + /* + The following uint3korr() may read 4 bytes, so make sure we don't + read unallocated or uninitialized memory. The right-hand expression + must match the size of the buffer allocated in net_realloc(). + */ + DBUG_ASSERT(net->where_b + NET_HEADER_SIZE + sizeof(uint32) <= + net->max_packet + NET_HEADER_SIZE + COMP_HEADER_SIZE + 1); /* If the packet is compressed then complen > 0 and contains the number of bytes in the uncompressed packet |