1 files changed, 48 insertions, 27 deletions

diff --git a/sql/sql_load.cc b/sql/sql_load.cc
index 4e6d91b9c1f..c2c97a37633 100644
--- a/sql/sql_load.cc
+++ b/sql/sql_load.cc
@@ -1387,7 +1387,7 @@ READ_INFO::READ_INFO(File file_par, uint tot_length, CHARSET_INFO *cs,
   set_if_bigger(length,line_start.length());
   stack=stack_pos=(int*) sql_alloc(sizeof(int)*length);
 
-  if (!(buffer=(uchar*) my_malloc(buff_length+1,MYF(MY_THREAD_SPECIFIC))))
+  if (!(buffer=(uchar*) my_malloc(buff_length+1,MYF(MY_WME | MY_THREAD_SPECIFIC))))
     error=1; /* purecov: inspected */
   else
   {
@@ -1573,37 +1573,50 @@ int READ_INFO::read_field()
 	}
       }
 #ifdef USE_MB
-      if (my_mbcharlen(read_charset, chr) > 1 &&
-          to + my_mbcharlen(read_charset, chr) <= end_of_buff)
-      {
-        uchar* p= to;
-        int ml, i;
-        *to++ = chr;
-
-        ml= my_mbcharlen(read_charset, chr);
+        uint ml= my_mbcharlen(read_charset, chr);
+        if (ml == 0)
+        {
+          *to= '\0';
+          my_error(ER_INVALID_CHARACTER_STRING, MYF(0),
+                   read_charset->csname, buffer);
+          error= true;
+          return 1;
+        }
 
-        for (i= 1; i < ml; i++) 
+        if (ml > 1 &&
+            to + ml <= end_of_buff)
         {
-          chr= GET;
-          if (chr == my_b_EOF)
+          uchar* p= to;
+          *to++ = chr;
+
+          for (uint i= 1; i < ml; i++)
           {
-            /*
-             Need to back up the bytes already ready from illformed
-             multi-byte char 
-            */
-            to-= i;
-            goto found_eof;
+            chr= GET;
+            if (chr == my_b_EOF)
+            {
+              /*
+                Need to back up the bytes already ready from illformed
+                multi-byte char 
+              */
+              to-= i;
+              goto found_eof;
+            }
+            *to++ = chr;
           }
-          *to++ = chr;
-        }
-        if (my_ismbchar(read_charset,
+          if (my_ismbchar(read_charset,
                         (const char *)p,
                         (const char *)to))
-          continue;
-        for (i= 0; i < ml; i++)
-          PUSH(*--to);
-        chr= GET;
-      }
+            continue;
+          for (uint i= 0; i < ml; i++)
+            PUSH(*--to);
+          chr= GET;
+        }
+        else if (ml > 1)
+        {
+          // Buffer is too small, exit while loop, and reallocate.
+          PUSH(chr);
+          break;
+        }
 #endif
       *to++ = (uchar) chr;
     }
@@ -1847,7 +1860,15 @@ int READ_INFO::read_value(int delim, String *val)
   for (chr= GET; my_tospace(chr) != delim && chr != my_b_EOF;)
   {
 #ifdef USE_MB
-    if (my_mbcharlen(read_charset, chr) > 1)
+    uint ml= my_mbcharlen(read_charset, chr);
+    if (ml == 0)
+    {
+      chr= my_b_EOF;
+      val->length(0);
+      return chr;
+    }
+
+    if (ml > 1)
     {
       DBUG_PRINT("read_xml",("multi byte"));
       int i, ml= my_mbcharlen(read_charset, chr);