1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug #25111907: XML TEST FAILS WITH UNDEFINED BEHAVIOR

Browse Source 
The XML parser position stack for each level is with a fixed depth.
So a bounds check was done to ensure that this depth is not exceeded.
But it was off by one (i.e. the size of the array was a valid index).
Fixed by decreasing the allowable depth by one to match the maximum
number of elements in the position stack.
This commit is contained in:
Georgi Kodinov 2016-12-05 15:36:23 +02:00
parent 6722699551
commit dafbdc788a
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sql/item_xmlfunc.cc
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -2695,9 +2695,9 @@ int xml_enter(MY_XML_PARSER *st,const char *attr, size_t len)
node.parent= data->parent; // Set parent for the new node to old parent
data->parent= numnodes; // Remember current node as new parent
DBUG_ASSERT(data->level <= MAX_LEVEL);
DBUG_ASSERT(data->level < MAX_LEVEL);
data->pos[data->level]= numnodes;
if (data->level < MAX_LEVEL)
if (data->level < MAX_LEVEL - 1)
node.level= data->level++;
else
return MY_XML_ERROR;