1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix for bug #51875: crash when loading data into geometry function polyfromwkb

Browse Source 
Check for number of line strings in the incoming polygon data (wkb) and
for number of points in the incoming linestring wkb.
This commit is contained in:
Ramil Kalimullin 2010-08-30 11:51:46 +04:00
parent 74c32d69b0
commit 9c6143ef80
3 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
mysql-test/r/gis.result
View File

@ -1057,4 +1057,11 @@ NULL
SELECT Polygon(12345123,'');
Polygon(12345123,'')
NULL
#
# BUG#51875: crash when loading data into geometry function polyfromwkb
#
SET @a=0x00000000030000000100000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
SET @a=0x00000000030000000000000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
End of 5.1 tests

10
mysql-test/t/gis.test
View File

@ -722,4 +722,14 @@ SELECT Polygon(123451,'');
SELECT Polygon(1234512,'');
SELECT Polygon(12345123,'');
--echo #
--echo # BUG#51875: crash when loading data into geometry function polyfromwkb
--echo #
SET @a=0x00000000030000000100000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
SET @a=0x00000000030000000000000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
--echo End of 5.1 tests

6
sql/spatial.cc
View File

@ -528,7 +528,7 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len,
n_points= wkb_get_uint(wkb, bo);
proper_length= 4 + n_points * POINT_DATA_SIZE;
if (len < proper_length || res->reserve(proper_length))
if (!n_points || len < proper_length || res->reserve(proper_length))
return 0;
res->q_append(n_points);
@ -746,7 +746,9 @@ uint Gis_polygon::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo,
if (len < 4)
return 0;
n_linear_rings= wkb_get_uint(wkb, bo);
if (!(n_linear_rings= wkb_get_uint(wkb, bo)))
return 0;
if (res->reserve(4, 512))
return 0;
wkb+= 4;