MDEV-5735 Selecting from SEQUENCE table with negative number hangs server

3 files changed, 22 insertions, 4 deletions

diff --git a/storage/sequence/mysql-test/sequence/simple.result b/storage/sequence/mysql-test/sequence/simple.result
index 2802cdeb977..8ce4722aeff 100644
--- a/storage/sequence/mysql-test/sequence/simple.result
+++ b/storage/sequence/mysql-test/sequence/simple.result
@@ -40,6 +40,10 @@ show create table se;
 ERROR 42S02: Table 'test.se' doesn't exist
 show create table seq_1_to_15_step_0;
 ERROR HY000: Got error 140 "Wrong create options" from storage engine SEQUENCE
+show create table `seq_-1_to_15`;
+ERROR 42S02: Table 'test.seq_-1_to_15' doesn't exist
+show create table `seq_1_to_+2`;
+ERROR 42S02: Table 'test.seq_1_to_+2' doesn't exist
 select * from seq_1_to_15_step_2;
 seq
 1
diff --git a/storage/sequence/mysql-test/sequence/simple.test b/storage/sequence/mysql-test/sequence/simple.test
index fd5b6c6d50c..fbf2b0ebc66 100644
--- a/storage/sequence/mysql-test/sequence/simple.test
+++ b/storage/sequence/mysql-test/sequence/simple.test
@@ -26,6 +26,14 @@ show create table se;
 --error ER_GET_ERRNO
 show create table seq_1_to_15_step_0;
 
+#
+# MDEV-5735 Selecting from SEQUENCE table with negative number hangs server
+#
+--error ER_NO_SUCH_TABLE
+show create table `seq_-1_to_15`;
+--error ER_NO_SUCH_TABLE
+show create table `seq_1_to_+2`;
+
 # simple select
 select * from seq_1_to_15_step_2;
 select * from seq_1_to_15;
diff --git a/storage/sequence/sequence.cc b/storage/sequence/sequence.cc
index ab22037d884..0d92c324724 100644
--- a/storage/sequence/sequence.cc
+++ b/storage/sequence/sequence.cc
@@ -20,6 +20,7 @@
   a engine that auto-creates tables with rows filled with sequential values
 */
 
+#include <ctype.h>
 #include <mysql_version.h>
 #include <handler.h>
 #include <table.h>
@@ -265,14 +266,19 @@ static handler *create_handler(handlerton *hton, TABLE_SHARE *table,
 static bool parse_table_name(const char *name, size_t name_length,
                              ulonglong *from, ulonglong *to, ulonglong *step)
 {
-  uint n1= 0, n2= 0;
+  uint n0=0, n1= 0, n2= 0;
   *step= 1;
 
   // the table is discovered if its name matches the pattern of seq_1_to_10 or 
   // seq_1_to_10_step_3
-  sscanf(name, "seq_%llu_to_%llu%n_step_%llu%n",
-         from, to, &n1, step, &n2);
-  return n1 != name_length && n2 != name_length;
+  sscanf(name, "seq_%llu_to_%n%llu%n_step_%llu%n",
+         from, &n0, to, &n1, step, &n2);
+  // I consider this a bug in sscanf() - when an unsigned number
+  // is requested, -5 should *not* be accepted. But is is :(
+  // hence the additional check below:
+  return
+    n0 == 0 || !isdigit(name[4]) || !isdigit(name[n0]) || // reject negative numbers
+    (n1 != name_length && n2 != name_length);
 }