diff --git a/mysql-test/r/gis.result b/mysql-test/r/gis.result index 6ea977d5bfd..b6521636685 100644 --- a/mysql-test/r/gis.result +++ b/mysql-test/r/gis.result @@ -1108,4 +1108,10 @@ NULL SELECT Centroid( AsBinary( LineString(Point(0,0), Point(0,0), Point(0,0) ))); Centroid( AsBinary( LineString(Point(0,0), Point(0,0), Point(0,0) ))) NULL +# +# MDEV-4295 Server crashes in get_point on a query with Area, AsBinary, MultiPoint +# +SELECT Area(AsBinary(MultiPoint(Point(0,9), Point(0,1), Point(2,2)))); +Area(AsBinary(MultiPoint(Point(0,9), Point(0,1), Point(2,2)))) +NULL End of 5.1 tests diff --git a/mysql-test/t/gis.test b/mysql-test/t/gis.test index b8cce077e3e..698b9455da3 100644 --- a/mysql-test/t/gis.test +++ b/mysql-test/t/gis.test @@ -839,4 +839,9 @@ select geometryn(0x0100000000070000000100000001030000000200000000000000ffffff0f, --echo # SELECT Centroid( AsBinary( LineString(Point(0,0), Point(0,0), Point(0,0) ))); + +--echo # +--echo # MDEV-4295 Server crashes in get_point on a query with Area, AsBinary, MultiPoint +--echo # +SELECT Area(AsBinary(MultiPoint(Point(0,9), Point(0,1), Point(2,2)))); --echo End of 5.1 tests diff --git a/sql/spatial.cc b/sql/spatial.cc index afaa67763e8..52110960f96 100644 --- a/sql/spatial.cc +++ b/sql/spatial.cc @@ -868,7 +868,7 @@ int Gis_polygon::area(double *ar, const char **end_of_data) const if (no_data(data, 4)) return 1; n_points= uint4korr(data); - if (n_points > max_n_points || + if (n_points == 0 || n_points > max_n_points || no_data(data, (SIZEOF_STORED_DOUBLE*2) * n_points)) return 1; get_point(&prev_x, &prev_y, data+4); @@ -989,7 +989,7 @@ int Gis_polygon::centroid_xy(double *x, double *y) const return 1; org_n_points= n_points= uint4korr(data); data+= 4; - if (n_points > max_n_points || + if (n_points == 0 || n_points > max_n_points || no_data(data, (SIZEOF_STORED_DOUBLE*2) * n_points)) return 1; get_point(&prev_x, &prev_y, data);