1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix for BUG#15948580 UPDATE_XML() CRASHES THE SERVER.

Browse Source 
Problem: tag's buffer overflow leads to a problem.
Fix: bound check added.
This commit is contained in:
Ramil Kalimullin 2012-12-14 13:55:30 +04:00
parent 0b10e6d03f
commit b92b7a42fd
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sql/item_xmlfunc.cc
View File

@ -2669,8 +2669,12 @@ int xml_enter(MY_XML_PARSER *st,const char *attr, size_t len)
node.parent= data->parent; // Set parent for the new node to old parent
data->parent= numnodes; // Remember current node as new parent
DBUG_ASSERT(data->level <= MAX_LEVEL);
data->pos[data->level]= numnodes;
node.level= data->level++;
if (data->level < MAX_LEVEL)
node.level= data->level++;
else
return MY_XML_ERROR;
node.type= st->current_node_type; // TAG or ATTR
node.beg= attr;
node.end= attr + len;