Commit 3fe96862 authored by Alexander Barkov's avatar Alexander Barkov

Backporting Bug 14100466 from 5.6.

parent a5ddcaab
......@@ -525,12 +525,13 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len,
const char *wkb_end;
Gis_point p;
if (len < 4)
if (len < 4 ||
(n_points= wkb_get_uint(wkb, bo)) < 1 ||
n_points > max_n_points)
return 0;
n_points= wkb_get_uint(wkb, bo);
proper_length= 4 + n_points * POINT_DATA_SIZE;
if (!n_points || len < proper_length || res->reserve(proper_length))
if (len < proper_length || res->reserve(proper_length))
return 0;
res->q_append(n_points);
......@@ -1072,9 +1073,9 @@ uint Gis_multi_point::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo,
Gis_point p;
const char *wkb_end;
if (len < 4)
if (len < 4 ||
(n_points= wkb_get_uint(wkb, bo)) > max_n_points)
return 0;
n_points= wkb_get_uint(wkb, bo);
proper_size= 4 + n_points * (WKB_HEADER_SIZE + POINT_DATA_SIZE);
if (len < proper_size || res->reserve(proper_size))
......
......@@ -379,6 +379,10 @@ public:
class Gis_line_string: public Geometry
{
// Maximum number of points in LineString that can fit into String
static const uint32 max_n_points=
(uint32) (UINT_MAX32 - WKB_HEADER_SIZE - 4 /* n_points */) /
POINT_DATA_SIZE;
public:
Gis_line_string() {} /* Remove gcc warning */
virtual ~Gis_line_string() {} /* Remove gcc warning */
......@@ -435,6 +439,10 @@ public:
class Gis_multi_point: public Geometry
{
// Maximum number of points in MultiPoint that can fit into String
static const uint32 max_n_points=
(uint32) (UINT_MAX32 - WKB_HEADER_SIZE - 4 /* n_points */) /
(WKB_HEADER_SIZE + POINT_DATA_SIZE);
public:
Gis_multi_point() {} /* Remove gcc warning */
virtual ~Gis_multi_point() {} /* Remove gcc warning */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment