From aa668865e271694e9b3ebbfe518cb4d0c2ad0c38 Mon Sep 17 00:00:00 2001 From: Alexander Barkov Date: Thu, 11 Nov 2010 13:25:23 +0300 Subject: Bug#57257 Replace(ExtractValue(...)) causes MySQL crash Bug#57820 extractvalue crashes Problem: ExtractValue and Replace crashed in some cases due to invalid handling of empty and NULL arguments. Per file comments: @mysql-test/r/ctype_ujis.result @mysql-test/r/xml.result @mysql-test/t/ctype_ujis.test @mysql-test/t/xml.test Adding tests @sql/item_strfunc.cc Make sure Item_func_replace::val_str safely handles empty strings. @sql/item_xmlfunc.cc set null_value if nodeset_func returned NULL, which is possible when the second argument is an unset user variable. --- mysql-test/t/xml.test | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'mysql-test/t/xml.test') diff --git a/mysql-test/t/xml.test b/mysql-test/t/xml.test index 6e7d38cdfca..a8917fc9fe7 100644 --- a/mysql-test/t/xml.test +++ b/mysql-test/t/xml.test @@ -617,4 +617,15 @@ FROM t1 ORDER BY t1.id; DROP TABLE t1; +--echo # +--echo # Bug#57257 Replace(ExtractValue(...)) causes MySQL crash +--echo # +SET NAMES utf8; +SELECT REPLACE(EXTRACTVALUE('1', '/a'),'ds',''); + +--echo # +--echo # Bug #57820 extractvalue crashes +--echo # +SELECT AVG(DISTINCT EXTRACTVALUE((''),('$@k'))); + --echo End of 5.1 tests -- cgit v1.2.1 From 8f4af421459d01a48e66a3279c174ef17ed486c0 Mon Sep 17 00:00:00 2001 From: Alexander Barkov Date: Thu, 18 Nov 2010 16:11:18 +0300 Subject: Bug#57279 updatexml dies with: Assertion failed: str_arg[length] == 0 Problem: crash in Item_float constructor on DBUG_ASSERT due to not null-terminated string parameter. Fix: making Item_float::Item_float non-null-termintated parameter safe: - Using temporary buffer when generating error modified: @ mysql-test/r/xml.result @ mysql-test/t/xml.test @ sql/item.cc --- mysql-test/t/xml.test | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'mysql-test/t/xml.test') diff --git a/mysql-test/t/xml.test b/mysql-test/t/xml.test index 6e7d38cdfca..e9f137adf1b 100644 --- a/mysql-test/t/xml.test +++ b/mysql-test/t/xml.test @@ -617,4 +617,14 @@ FROM t1 ORDER BY t1.id; DROP TABLE t1; +--echo # +--echo # Bug#57279 updatexml dies with: Assertion failed: str_arg[length] == 0 +--echo # + +--error ER_ILLEGAL_VALUE_FOR_TYPE +SELECT UPDATEXML(NULL, (LPAD(0.1111E-15, '2011', 1)), 1); +--error ER_ILLEGAL_VALUE_FOR_TYPE +SELECT EXTRACTVALUE('', LPAD(0.1111E-15, '2011', 1)); + + --echo End of 5.1 tests -- cgit v1.2.1