VladPolskiy/MariaDB-open-code
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-23 00:29:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bug#55436: buffer overflow in debug binary of dbug_buff in Field_new_decimal::store_value

Browse Source 
There were some misunderstandings about parameters pertaining to buffer-size.

Patches fixes the reported off by one and
clarifies the documentation.

mysql-test/r/type_newdecimal.result:
  add test
mysql-test/t/type_newdecimal.test:
  add test
sql/field.cc:
  adjust buffer size by one to account for terminator.
sql/my_decimal.cc:
  adjust buffer size by one to account for terminator.
  clarify needs in comments.
sql/my_decimal.h:
  clarify buffer-size needs to prevent future off-by-one bugs.
strings/decimal.c:
  clarify buffer-size needs and parameters to prevent future off-by-one bugs
This commit is contained in:
Tatiana A. Nurnberg
2010-11-11 09:46:49 +00:00
parent 58dfba2899
commit ccbc24b45a
6 changed files with 41 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
sql/my_decimal.cc
View File

@ -95,10 +95,11 @@ int my_decimal2string(uint mask, const my_decimal *d,
UNSIGNED. Hence the buffer for a ZEROFILLed value is the length
the user requested, plus one for a possible decimal point, plus
one if the user only wanted decimal places, but we force a leading
zero on them. Because the type is implicitly UNSIGNED, we do not
need to reserve a character for the sign. For all other cases,
fixed_prec will be 0, and my_decimal_string_length() will be called
instead to calculate the required size of the buffer.
zero on them, plus one for the '\0' terminator. Because the type
is implicitly UNSIGNED, we do not need to reserve a character for
the sign. For all other cases, fixed_prec will be 0, and
my_decimal_string_length() will be called instead to calculate the
required size of the buffer.
*/
int length= (fixed_prec
? (fixed_prec + ((fixed_prec == fixed_dec) ? 1 : 0) + 1)
@ -275,7 +276,7 @@ print_decimal_buff(const my_decimal *dec, const uchar* ptr, int length)
const char *dbug_decimal_as_string(char *buff, const my_decimal *val)
{
int length= DECIMAL_MAX_STR_LENGTH;
int length= DECIMAL_MAX_STR_LENGTH + 1; /* minimum size for buff */
if (!val)
return "NULL";
(void)decimal2string((decimal_t*) val, buff, &length, 0,0,0);