From fd8bf58ca972ef3f521aec03c0bd09fa3ec78335 Mon Sep 17 00:00:00 2001
From: Alexey Kopytov <Alexey.Kopytov@sun.com>
Date: Tue, 10 Feb 2009 15:38:56 +0300
Subject: [PATCH] Fix for bug #41868: crash or memory overrun with concat +
 upper,                     date_format functions

String::realloc() did not check whether the existing string data fits in
the newly allocated buffer for cases when reallocating a String object
with external buffer (i.e.alloced == FALSE).  This could lead to memory
overruns in some cases.

client/sql_string.cc:
  Fixed String::realloc() to check whether the existing string data fits
  in the newly allocated buffer for cases when reallocating a String
  object with external buffer.
mysql-test/r/func_str.result:
  Added a test case for bug #41868.
mysql-test/t/func_str.test:
  Added a test case for bug #41868.
sql/sql_class.cc:
  After each call to Item::send() in select_send::send_data() reset
  buffer to its original state to reduce unnecessary malloc() calls. See
  comments for bug #41868 for detailed analysis.
sql/sql_string.cc:
  Fixed String::realloc() to check whether the existing string data fits
  in the newly allocated buffer for cases when reallocating a String
  object with external buffer.
---
 client/sql_string.cc         | 15 ++++++---------
 mysql-test/r/func_str.result |  6 ++++++
 mysql-test/t/func_str.test   |  9 +++++++++
 sql/sql_class.cc             |  5 +++++
 sql/sql_string.cc            | 15 ++++++---------
 5 files changed, 32 insertions(+), 18 deletions(-)

diff --git a/client/sql_string.cc b/client/sql_string.cc
index 9d887ff031c..fe1fd83a6f6 100644
--- a/client/sql_string.cc
+++ b/client/sql_string.cc
@@ -71,25 +71,22 @@ bool String::realloc(uint32 alloc_length)
     char *new_ptr;
     if (alloced)
     {
-      if ((new_ptr= (char*) my_realloc(Ptr,len,MYF(MY_WME))))
-      {
-	Ptr=new_ptr;
-	Alloced_length=len;
-      }
-      else
-	return TRUE;				// Signal error
+      if (!(new_ptr= (char*) my_realloc(Ptr,len,MYF(MY_WME))))
+        return TRUE;				// Signal error
     }
     else if ((new_ptr= (char*) my_malloc(len,MYF(MY_WME))))
     {
+      if (str_length > len - 1)
+        str_length= 0;
       if (str_length)				// Avoid bugs in memcpy on AIX
 	memcpy(new_ptr,Ptr,str_length);
       new_ptr[str_length]=0;
-      Ptr=new_ptr;
-      Alloced_length=len;
       alloced=1;
     }
     else
       return TRUE;			// Signal error
+    Ptr= new_ptr;
+    Alloced_length= len;
   }
   Ptr[alloc_length]=0;			// This make other funcs shorter
   return FALSE;
diff --git a/mysql-test/r/func_str.result b/mysql-test/r/func_str.result
index c121c8937d7..d7fd8c5c887 100644
--- a/mysql-test/r/func_str.result
+++ b/mysql-test/r/func_str.result
@@ -2181,4 +2181,10 @@ def					format(a, 2)	253	20	4	Y	0	2	8
 format(a, 2)
 1.33
 drop table t1;
+CREATE TABLE t1 (c DATE, aa VARCHAR(30));
+INSERT INTO t1 VALUES ('2008-12-31','aaaaaa');
+SELECT DATE_FORMAT(c, GET_FORMAT(DATE, 'eur')) h, CONCAT(UPPER(aa),', ', aa) i FROM t1;
+h	i
+31.12.2008	AAAAAA, aaaaaa
+DROP TABLE t1;
 End of 5.0 tests
diff --git a/mysql-test/t/func_str.test b/mysql-test/t/func_str.test
index 8298a50c277..389538c4cc0 100644
--- a/mysql-test/t/func_str.test
+++ b/mysql-test/t/func_str.test
@@ -1159,4 +1159,13 @@ select format(a, 2) from t1;
 --disable_metadata
 drop table t1;
 
+#
+# Bug #41868: crash or memory overrun with concat + upper, date_format functions
+#
+
+CREATE TABLE t1 (c DATE, aa VARCHAR(30));
+INSERT INTO t1 VALUES ('2008-12-31','aaaaaa');
+SELECT DATE_FORMAT(c, GET_FORMAT(DATE, 'eur')) h, CONCAT(UPPER(aa),', ', aa) i FROM t1;
+DROP TABLE t1;
+
 --echo End of 5.0 tests
diff --git a/sql/sql_class.cc b/sql/sql_class.cc
index 91c0aa66761..9ff602bb62e 100644
--- a/sql/sql_class.cc
+++ b/sql/sql_class.cc
@@ -1047,6 +1047,11 @@ bool select_send::send_data(List<Item> &items)
       my_message(ER_OUT_OF_RESOURCES, ER(ER_OUT_OF_RESOURCES), MYF(0));
       break;
     }
+    /*
+      Reset buffer to its original state, as it may have been altered in
+      Item::send().
+    */
+    buffer.set(buff, sizeof(buff), &my_charset_bin);
   }
   thd->sent_row_count++;
   if (!thd->vio_ok())
diff --git a/sql/sql_string.cc b/sql/sql_string.cc
index 75e47dd0c8e..ed1dc9eac77 100644
--- a/sql/sql_string.cc
+++ b/sql/sql_string.cc
@@ -71,25 +71,22 @@ bool String::realloc(uint32 alloc_length)
     char *new_ptr;
     if (alloced)
     {
-      if ((new_ptr= (char*) my_realloc(Ptr,len,MYF(MY_WME))))
-      {
-	Ptr=new_ptr;
-	Alloced_length=len;
-      }
-      else
-	return TRUE;				// Signal error
+      if (!(new_ptr= (char*) my_realloc(Ptr,len,MYF(MY_WME))))
+        return TRUE;				// Signal error
     }
     else if ((new_ptr= (char*) my_malloc(len,MYF(MY_WME))))
     {
+      if (str_length > len - 1)
+        str_length= 0;
       if (str_length)				// Avoid bugs in memcpy on AIX
 	memcpy(new_ptr,Ptr,str_length);
       new_ptr[str_length]=0;
-      Ptr=new_ptr;
-      Alloced_length=len;
       alloced=1;
     }
     else
       return TRUE;			// Signal error
+    Ptr= new_ptr;
+    Alloced_length= len;
   }
   Ptr[alloc_length]=0;			// This make other funcs shorter
   return FALSE;