1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug #59632 Assertion failed: arg_length > length

Browse Source 
The problem was overflow in max_length when we tried to des_decrypt()
something which is not the output of des_encrypt()
This commit is contained in:
Tor Didriksen 2011-02-07 11:17:46 +01:00
parent d7e3a54271
commit 410cb8dfc5
3 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
mysql-test/r/ssl_and_innodb.result Normal file
View File

@ -0,0 +1,8 @@
CREATE TABLE t1(a int) engine=innodb;
INSERT INTO t1 VALUES (1);
SELECT DISTINCT
convert((SELECT des_decrypt(2,1) AS a FROM t1 WHERE @a:=1), signed) as d
FROM t1 ;
d
2
DROP TABLE t1;

11
mysql-test/t/ssl_and_innodb.test Normal file
View File

@ -0,0 +1,11 @@
-- source include/have_innodb.inc
-- source include/have_ssl_crypto_functs.inc
CREATE TABLE t1(a int) engine=innodb;
INSERT INTO t1 VALUES (1);
SELECT DISTINCT
convert((SELECT des_decrypt(2,1) AS a FROM t1 WHERE @a:=1), signed) as d
FROM t1 ;
DROP TABLE t1;

6
sql/item_strfunc.h
View File

@ -1,7 +1,7 @@
#ifndef ITEM_STRFUNC_INCLUDED #ifndef ITEM_STRFUNC_INCLUDED
#define ITEM_STRFUNC_INCLUDED #define ITEM_STRFUNC_INCLUDED
/* Copyright (C) 2000-2003 MySQL AB /* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by it under the terms of the GNU General Public License as published by
@ -361,7 +361,9 @@ public:
{ {
maybe_null=1; maybe_null=1;
/* 9 = MAX ((8- (arg_len % 8)) + 1) */ /* 9 = MAX ((8- (arg_len % 8)) + 1) */
max_length = args[0]->max_length - 9; max_length= args[0]->max_length;
if (max_length >= 9U)
max_length-= 9U;
} }
const char *func_name() const { return "des_decrypt"; } const char *func_name() const { return "des_decrypt"; }
}; };