diff options
| author | Sergey Glukhov <Sergey.Glukhov@sun.com> | 2009-06-02 11:38:13 +0500 |
|---|---|---|
| committer | Sergey Glukhov <Sergey.Glukhov@sun.com> | 2009-06-02 11:38:13 +0500 |
| commit | 33734e956fb06435168ad4630515c02358871a0e (patch) | |
| tree | feaf78789a7104118740c975304683318faad5ae /sql | |
| parent | 47b334a64200d9413d3289fb3f011a6f4bc22ec2 (diff) | |
| download | mariadb-git-33734e956fb06435168ad4630515c02358871a0e.tar.gz | |
Bug#45152 crash with round() function on longtext column in a derived table
The crash happens due to wrong max_length value which is set on
Item_func_round::fix_length_and_dec() stage. The value is set to
args[0]->max_length which is too big in case of LONGTEXT(LONGBLOB) fields.
The fix is to set max_length using float_length() function.
mysql-test/r/func_math.result:
test result
mysql-test/t/func_math.test:
test case
sql/item_func.cc:
The crash happens due to wrong max_length value which is set on
Item_func_round::fix_length_and_dec() stage. The value is set to
args[0]->max_length which is too big in case of LONGTEXT(LONGBLOB) fields.
The fix is to set max_length using float_length() function.
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/item_func.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sql/item_func.cc b/sql/item_func.cc index 46e0f30d94e..2421f7e0526 100644 --- a/sql/item_func.cc +++ b/sql/item_func.cc @@ -1958,8 +1958,8 @@ void Item_func_round::fix_length_and_dec() unsigned_flag= args[0]->unsigned_flag; if (!args[1]->const_item()) { - max_length= args[0]->max_length; decimals= args[0]->decimals; + max_length= float_length(decimals); if (args[0]->result_type() == DECIMAL_RESULT) { max_length++; @@ -1979,8 +1979,8 @@ void Item_func_round::fix_length_and_dec() if (args[0]->decimals == NOT_FIXED_DEC) { - max_length= args[0]->max_length; decimals= min(decimals_to_set, NOT_FIXED_DEC); + max_length= float_length(decimals); hybrid_type= REAL_RESULT; return; } |