1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug #59241 invalid memory read in do_div_mod with doubly assigned variables

Browse Source 
Fix: copy my_decimal by value, to avoid dangling pointers.
This commit is contained in:
Tor Didriksen 2011-01-14 10:05:14 +01:00
parent cfa9a4bde6
commit 8dfab82ee0
7 changed files with 44 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
mysql-test/r/func_math.result
View File

@ -641,3 +641,12 @@ INSERT INTO t1 (SELECT -pi());
Warnings:
Warning 1265 Data truncated for column 'a' at row 1
DROP TABLE t1;
#
# Bug #59241 invalid memory read
# in do_div_mod with doubly assigned variables
#
SELECT ((@a:=@b:=1.0) div (@b:=@a:=get_format(datetime, 'usa')));
((@a:=@b:=1.0) div (@b:=@a:=get_format(datetime, 'usa')))
NULL
Warnings:
Warning 1366 Incorrect decimal value: '' for column '' at row -1

6
mysql-test/t/func_math.test
View File

@ -489,3 +489,9 @@ as foo;
CREATE TABLE t1(a char(0));
INSERT INTO t1 (SELECT -pi());
DROP TABLE t1;
--echo #
--echo # Bug #59241 invalid memory read
--echo # in do_div_mod with doubly assigned variables
--echo #
SELECT ((@a:=@b:=1.0) div (@b:=@a:=get_format(datetime, 'usa')));

3
sql/item_cmpfunc.cc
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -2086,7 +2086,6 @@ void Item_func_interval::fix_length_and_dec()
if (dec != &range->dec)
{
range->dec= *dec;
range->dec.fix_buffer_pointer();
}
}
else

16
sql/item_func.cc
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -1581,24 +1581,22 @@ longlong Item_func_int_div::val_int()
if (args[0]->result_type() != INT_RESULT ||
args[1]->result_type() != INT_RESULT)
{
my_decimal value0, value1, tmp;
my_decimal *val0, *val1;
longlong res;
int err;
val0= args[0]->val_decimal(&value0);
val1= args[1]->val_decimal(&value1);
my_decimal tmp;
my_decimal val0= *args[0]->val_decimal(&tmp);
my_decimal val1= *args[1]->val_decimal(&tmp);
if ((null_value= (args[0]->null_value || args[1]->null_value)))
return 0;
int err;
if ((err= my_decimal_div(E_DEC_FATAL_ERROR & ~E_DEC_DIV_ZERO, &tmp,
val0, val1, 0)) > 3)
&val0, &val1, 0)) > 3)
{
if (err == E_DEC_DIV_ZERO)
signal_divide_by_null();
return 0;
}
longlong res;
if (my_decimal2int(E_DEC_FATAL_ERROR, &tmp, unsigned_flag, &res) &
E_DEC_OVERFLOW)
raise_integer_overflow();

21
sql/my_decimal.h
View File

@ -1,4 +1,4 @@
/* Copyright (C) 2005-2006 MySQL AB
/* Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -102,6 +102,24 @@ class my_decimal :public decimal_t
public:
my_decimal(const my_decimal &rhs) : decimal_t(rhs)
{
for (uint i= 0; i < DECIMAL_BUFF_LENGTH; i++)
buffer[i]= rhs.buffer[i];
fix_buffer_pointer();
}
my_decimal& operator=(const my_decimal &rhs)
{
if (this == &rhs)
return *this;
decimal_t::operator=(rhs);
for (uint i= 0; i < DECIMAL_BUFF_LENGTH; i++)
buffer[i]= rhs.buffer[i];
fix_buffer_pointer();
return *this;
}
void init()
{
len= DECIMAL_BUFF_LENGTH;
@ -248,7 +266,6 @@ inline
void my_decimal2decimal(const my_decimal *from, my_decimal *to)
{
*to= *from;
to->fix_buffer_pointer();
}

7
sql/sql_analyse.cc
View File

@ -1,4 +1,4 @@
/* Copyright (C) 2000-2006 MySQL AB
/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -521,9 +521,6 @@ void field_decimal::add()
{
found = 1;
min_arg = max_arg = sum[0] = *dec;
min_arg.fix_buffer_pointer();
max_arg.fix_buffer_pointer();
sum[0].fix_buffer_pointer();
my_decimal_mul(E_DEC_FATAL_ERROR, sum_sqr, dec, dec);
cur_sum= 0;
min_length = max_length = length;
@ -545,12 +542,10 @@ void field_decimal::add()
if (my_decimal_cmp(dec, &min_arg) < 0)
{
min_arg= *dec;
min_arg.fix_buffer_pointer();
}
if (my_decimal_cmp(dec, &max_arg) > 0)
{
max_arg= *dec;
max_arg.fix_buffer_pointer();
}
}
}

4
strings/decimal.c
View File

@ -1,4 +1,4 @@
/* Copyright (C) 2000 MySQL AB
/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -13,8 +13,6 @@
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */
#line 18 "decimal.c"
/*
=======================================================================
NOTE: this library implements SQL standard "exact numeric" type