Commit a7a6c6eb authored by holyfoot/hf@mysql.com/hfmain.(none)'s avatar holyfoot/hf@mysql.com/hfmain.(none)
Browse files

Bug #30955 geomfromtext() crasher. 

end-of-line check missed in Gis_read_stream::get_next_word,
what can lead to crashes (expecially with NULL strings).

End-of-line check added
parent da04109d

mysql-test/r/gis.result

+6 −0
Original line number Diff line number Diff line
@@ -724,4 +724,10 @@ SELECT * FROM t1; 
a

NULL

DROP TABLE t1;

CREATE TABLE `t1` ( `col9` set('a'), `col89` date);

INSERT INTO `t1` VALUES ('','0000-00-00');

select geomfromtext(col9,col89) as a from t1;

a

NULL

DROP TABLE t1;

End of 4.1 tests

mysql-test/t/gis.test

+8 −0
Original line number Diff line number Diff line
@@ -419,4 +419,12 @@ INSERT INTO t1 VALUES (NULL); 
SELECT * FROM t1;

DROP TABLE t1;



#

# Bug #30955 geomfromtext() crasher

#

CREATE TABLE `t1` ( `col9` set('a'), `col89` date);

INSERT INTO `t1` VALUES ('','0000-00-00');

select geomfromtext(col9,col89) as a from t1;

DROP TABLE t1;



--echo End of 4.1 tests

sql/gstream.cc

+1 −1
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ bool Gis_read_stream::get_next_word(LEX_STRING *res) 
  skip_space();

  res->str= (char*) m_cur;

  /* The following will also test for \0 */

  if (!my_isvar_start(&my_charset_bin, *m_cur))

  if ((m_cur >= m_limit) || !my_isvar_start(&my_charset_bin, *m_cur))

    return 1;



  /*