From bebcb221834a08e492c188fb064414c7dc131902 Mon Sep 17 00:00:00 2001 From: unknown Date: Fri, 28 Sep 2007 16:46:05 +0300 Subject: Bug #30587: mysql crashes when trying to group by TIME div NUMBER When calculating the result length of an integer DIV function the number of decimals was used without checking the result type first. Thus an uninitialized number of decimals was used for some types. This caused an excessive amount of memory to be allocated for the field's buffer and crashed the server. Fixed by using the number of decimals only for data types that can have decimals and thus have valid decimals number. mysql-test/r/func_math.result: Bug #30587: test case mysql-test/t/func_math.test: Bug #30587: test case sql/item_func.cc: Bug #30587: Don't use decimals on a type that doesn't have them. --- mysql-test/r/func_math.result | 46 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) (limited to 'mysql-test/r/func_math.result') diff --git a/mysql-test/r/func_math.result b/mysql-test/r/func_math.result index ace94217fdc..5ef528812e5 100644 --- a/mysql-test/r/func_math.result +++ b/mysql-test/r/func_math.result @@ -322,4 +322,50 @@ mod(5, cast(-2 as unsigned)) mod(5, 18446744073709551614) mod(5, -2) select pow(cast(-2 as unsigned), 5), pow(18446744073709551614, 5), pow(-2, 5); pow(cast(-2 as unsigned), 5) pow(18446744073709551614, 5) pow(-2, 5) 2.1359870359209e+96 2.1359870359209e+96 -32 +CREATE TABLE t1 (a timestamp, b varchar(20), c bit(1)); +INSERT INTO t1 VALUES('1998-09-23', 'str1', 1), ('2003-03-25', 'str2', 0); +SELECT a DIV 900 y FROM t1 GROUP BY y; +Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr +def y y 8 19 11 Y 32800 0 63 +y +22201025555 +22255916666 +SELECT DISTINCT a DIV 900 y FROM t1; +Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr +def y y 8 19 11 Y 32800 0 63 +y +22201025555 +22255916666 +SELECT b DIV 900 y FROM t1 GROUP BY y; +Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr +def y y 8 20 1 Y 32768 0 63 +y +0 +SELECT c DIV 900 y FROM t1 GROUP BY y; +Catalog Database Table Table_alias Column Column_alias Type Length Max length Is_null Flags Decimals Charsetnr +def y y 3 1 1 Y 32800 0 63 +y +0 +DROP TABLE t1; +CREATE TABLE t1(a LONGBLOB); +INSERT INTO t1 VALUES('1'),('2'),('3'); +SELECT DISTINCT (a DIV 254576881) FROM t1; +(a DIV 254576881) +0 +SELECT (a DIV 254576881) FROM t1 UNION ALL +SELECT (a DIV 254576881) FROM t1; +(a DIV 254576881) +0 +0 +0 +0 +0 +0 +DROP TABLE t1; +CREATE TABLE t1(a SET('a','b','c')); +INSERT INTO t1 VALUES ('a'); +SELECT a DIV 2 FROM t1 UNION SELECT a DIV 2 FROM t1; +a DIV 2 +0 +DROP TABLE t1; End of 5.0 tests -- cgit v1.2.1