1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#49134 5.1 server segfaults with 2byte collation file

Browse Source 
Problem: add_collation did not check that cs->number is smaller
than the number of elements in the array all_charsets[],
so server could crash when loading an Index.xml file with
a collation ID greater the number of elements 
(for example when downgrading from 5.5).

Fix: adding a condition to check that cs->number is not out of valid range.
This commit is contained in:
Alexander Barkov 2009-12-15 13:48:29 +04:00
parent ca049fbed8
commit 9c47ea8380
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
mysql-test/std_data/Index.xml
View File

@ -8,6 +8,13 @@
</rules>
</collation>
<collation name="utf8_hugeid_ci" id="2047000000">
<rules>
<reset>a</reset>
<s>b</s>
</rules>
</collation>
</charset>
<charset name="ucs2">

3
mysys/charset.c
View File

@ -220,7 +220,8 @@ copy_uca_collation(CHARSET_INFO *to, CHARSET_INFO *from)
static int add_collation(CHARSET_INFO *cs)
{
if (cs->name && (cs->number ||
(cs->number=get_collation_number_internal(cs->name))))
(cs->number=get_collation_number_internal(cs->name))) &&
cs->number < array_elements(all_charsets))
{
if (!all_charsets[cs->number])
{