diff options
| author | igor@rurik.mysql.com <> | 2006-09-20 08:08:57 -0700 |
|---|---|---|
| committer | igor@rurik.mysql.com <> | 2006-09-20 08:08:57 -0700 |
| commit | f2225cab27a2cfae4e18190159d95b9f6c5e10c7 (patch) | |
| tree | 233cc52e16acff8f5fc37736fcfbe43730aea711 /sql | |
| parent | 0279c91d9971556d767c544ec7492d056ce2df64 (diff) | |
| download | mariadb-git-f2225cab27a2cfae4e18190159d95b9f6c5e10c7.tar.gz | |
Fixed bug #22015: crash with GROUP_CONCAT over a derived table
that returns the results of aggregation by GROUP_CONCAT.
The crash was due to an overflow happened for the field
sortoder->length.
The fix prevents this overflow exploiting the fact that the
value of sortoder->length cannot be greater than the value of
thd->variables.max_sort_length.
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/filesort.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sql/filesort.cc b/sql/filesort.cc index 42d25dbbaee..f13354d5c72 100644 --- a/sql/filesort.cc +++ b/sql/filesort.cc @@ -1268,6 +1268,7 @@ sortlength(THD *thd, SORT_FIELD *sortorder, uint s_length, switch ((sortorder->result_type=sortorder->item->result_type())) { case STRING_RESULT: sortorder->length=sortorder->item->max_length; + set_if_smaller(sortorder->length, thd->variables.max_sort_length); if (use_strnxfrm((cs=sortorder->item->collation.collation))) { sortorder->length= cs->coll->strnxfrmlen(cs, sortorder->length); |