Commit 38339e1c authored by sergefp@mysql.com's avatar sergefp@mysql.com

Fix for BUG#7716: in in_string::set() take into account that the value returned

by item->val_str() may be a substring of the passed string. 
Disallow string=its_substring assignment in String::operator=().
parent e87bd60c
......@@ -28,3 +28,24 @@ length(format('nan', 2)) > 0
select concat("$",format(2500,2));
concat("$",format(2500,2))
$2,500.00
create table t1 ( a timestamp );
insert into t1 values ( '2004-01-06 12:34' );
select a from t1 where left(a+0,6) in ( left(20040106,6) );
a
2004-01-06 12:34:00
select a from t1 where left(a+0,6) = ( left(20040106,6) );
a
2004-01-06 12:34:00
select a from t1 where right(a+0,6) in ( right(20040106123400,6) );
a
2004-01-06 12:34:00
select a from t1 where right(a+0,6) = ( right(20040106123400,6) );
a
2004-01-06 12:34:00
select a from t1 where mid(a+0,6,3) in ( mid(20040106123400,6,3) );
a
2004-01-06 12:34:00
select a from t1 where mid(a+0,6,3) = ( mid(20040106123400,6,3) );
a
2004-01-06 12:34:00
drop table t1;
......@@ -23,3 +23,18 @@ select length(format('nan', 2)) > 0;
# Test for bug #628
#
select concat("$",format(2500,2));
# Test for BUG#7716
create table t1 ( a timestamp );
insert into t1 values ( '2004-01-06 12:34' );
select a from t1 where left(a+0,6) in ( left(20040106,6) );
select a from t1 where left(a+0,6) = ( left(20040106,6) );
select a from t1 where right(a+0,6) in ( right(20040106123400,6) );
select a from t1 where right(a+0,6) = ( right(20040106123400,6) );
select a from t1 where mid(a+0,6,3) in ( mid(20040106123400,6,3) );
select a from t1 where mid(a+0,6,3) = ( mid(20040106123400,6,3) );
drop table t1;
......@@ -1503,7 +1503,11 @@ void in_string::set(uint pos,Item *item)
String *str=((String*) base)+pos;
String *res=item->val_str(str);
if (res && res != str)
{
if (res->uses_buffer_owned_by(str))
res->copy();
*str= *res;
}
if (!str->charset())
{
CHARSET_INFO *cs;
......
......@@ -182,6 +182,11 @@ public:
{
if (&s != this)
{
/*
It is forbidden to do assignments like
some_string = substring_of_that_string
*/
DBUG_ASSERT(!s.uses_buffer_owned_by(this));
free();
Ptr=s.Ptr ; str_length=s.str_length ; Alloced_length=s.Alloced_length;
alloced=0;
......@@ -313,4 +318,9 @@ public:
/* Swap two string objects. Efficient way to exchange data without memcpy. */
void swap(String &s);
inline bool uses_buffer_owned_by(const String *s) const
{
return (s->alloced && Ptr >= s->Ptr && Ptr < s->Ptr + s->str_length);
}
};
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment