1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function

Browse Source 
Introduced by the fix for bug#44766.

Problem: it's not correct to use args[0]->str_value as a buffer,
because args[0] may need this buffer for its own purposes.

Fix: adding a new class member tmp_value to use as return value.

  @ mysql-test/r/ctype_many.result
  @ mysql-test/t/ctype_many.test
  Adding tests

  @ sql/item_strfunc.cc
  Changing code into traditional style:
  use "str" as a buffer for the argument and tmp_value for the result value.

  @ sql/item_strfunc.h
  Adding tmp_value
This commit is contained in:
Alexander Barkov 2011-01-17 15:11:33 +03:00
parent a2850a2f53
commit 6665ca25af
4 changed files with 35 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
mysql-test/r/ctype_many.result
View File

@ -1683,3 +1683,18 @@ ARMENIAN CAPIT DA 2
ARMENIAN CAPIT ECH 2
ARMENIAN CAPIT ZA 2
DROP TABLE t1;
#
# Start of 5.1 tests
#
#
# Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function
#
SET NAMES latin1;
DO CONVERT(CAST(SUBSTRING_INDEX(FORMAT(1,'1111'), FORMAT('','Zpq'),1)
AS BINARY(0)) USING utf8);
Warnings:
Warning 1292 Truncated incorrect INTEGER value: 'Zpq'
Warning 1292 Truncated incorrect BINARY(0) value: '1.'
#
# End of 5.1 tests
#

16
mysql-test/t/ctype_many.test
View File

@ -211,3 +211,19 @@ SELECT min(comment),count(*) FROM t1 GROUP BY ucs2_f;
DROP TABLE t1;
# End of 4.1 tests
--echo #
--echo # Start of 5.1 tests
--echo #
--echo #
--echo # Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function
--echo #
SET NAMES latin1;
DO CONVERT(CAST(SUBSTRING_INDEX(FORMAT(1,'1111'), FORMAT('','Zpq'),1)
AS BINARY(0)) USING utf8);
--echo #
--echo # End of 5.1 tests
--echo #

12
sql/item_strfunc.cc
View File

@ -2761,22 +2761,16 @@ String *Item_func_conv_charset::val_str(String *str)
DBUG_ASSERT(fixed == 1);
if (use_cached_value)
return null_value ? 0 : &str_value;
/*
Here we don't pass 'str' as a parameter to args[0]->val_str()
as 'str' may point to 'str_value' (e.g. see Item::save_in_field()),
which we use below to convert string.
Use argument's 'str_value' instead.
*/
String *arg= args[0]->val_str(&args[0]->str_value);
String *arg= args[0]->val_str(str);
uint dummy_errors;
if (!arg)
{
null_value=1;
return 0;
}
null_value= str_value.copy(arg->ptr(),arg->length(),arg->charset(),
null_value= tmp_value.copy(arg->ptr(), arg->length(), arg->charset(),
conv_charset, &dummy_errors);
return null_value ? 0 : check_well_formed_result(&str_value);
return null_value ? 0 : check_well_formed_result(&tmp_value);
}
void Item_func_conv_charset::fix_length_and_dec()

1
sql/item_strfunc.h
View File

@ -713,6 +713,7 @@ public:
class Item_func_conv_charset :public Item_str_func
{
bool use_cached_value;
String tmp_value;
public:
bool safe;
CHARSET_INFO *conv_charset; // keep it public