Merge abotchkov@bk-internal.mysql.com:/home/bk/mysql-4.1

into deer.(none):/home/hf/work/mysql-4.1.valg

sql/gstream.cc

@@ -24,7 +24,7 @@
 enum Gis_read_stream::enum_tok_types Gis_read_stream::get_next_toc_type()
 {
   skip_space();
-  if (!*m_cur)
+  if (m_cur >= m_limit)
     return eostream;
   if (my_isvar_start(&my_charset_bin, *m_cur))
     return word;
@@ -53,7 +53,7 @@ bool Gis_read_stream::get_next_word(LEX_STRING *res)
     my_isvar() is a macro that would cause side effects
   */
   m_cur++;
-  while (my_isvar(&my_charset_bin, *m_cur))
+  while ((m_cur < m_limit) && my_isvar(&my_charset_bin, *m_cur))
     m_cur++;
 
   res->length= (uint32) (m_cur - res->str);
@@ -71,16 +71,21 @@ bool Gis_read_stream::get_next_word(LEX_STRING *res)
 bool Gis_read_stream::get_next_number(double *d)
 {
   char *endptr;
+  int err;
 
   skip_space();
-  /* The following will also test for end \0 */
-  if ((*m_cur < '0' || *m_cur > '9') && *m_cur != '-' && *m_cur != '+')
+
+  if ((m_cur >= m_limit) ||
+      (*m_cur < '0' || *m_cur > '9') && *m_cur != '-' && *m_cur != '+')
   {
     set_error_msg("Numeric constant expected");
     return 1;
   }
 
-  *d = my_strtod(m_cur, &endptr);
+  *d = my_strntod(m_charset, (char *)m_cur,
+		  m_limit-m_cur, &endptr, &err);
+  if (err)
+    return 1;
   if (endptr)
     m_cur = endptr;
   return 0;
@@ -90,7 +95,7 @@ bool Gis_read_stream::get_next_number(double *d)
 bool Gis_read_stream::check_next_symbol(char symbol)
 {
   skip_space();
-  if (*m_cur != symbol)
+  if ((m_cur >= m_limit) || (*m_cur != symbol))
   {
     char buff[32];
     strmov(buff, "'?' expected");

sql/gstream.h

@@ -29,8 +29,8 @@ public:
     comma
   };
 
-  Gis_read_stream(const char *buffer, int size)
-    :m_cur(buffer), m_limit(buffer + size), m_err_msg(NULL)
+  Gis_read_stream(CHARSET_INFO *charset, const char *buffer, int size)
+    :m_cur(buffer), m_limit(buffer + size), m_err_msg(NULL), m_charset(charset)
   {}
   Gis_read_stream(): m_cur(NullS), m_limit(NullS), m_err_msg(NullS)
   {}
@@ -46,14 +46,14 @@ public:
 
   inline void skip_space()
   {
-    while (my_isspace(&my_charset_latin1, *m_cur))
+    while ((m_cur < m_limit) && my_isspace(&my_charset_latin1, *m_cur))
       m_cur++;
   }
   /* Skip next character, if match. Return 1 if no match */
   inline bool skip_char(char skip)
   {
     skip_space();
-    if (*m_cur != skip)
+    if ((m_cur >= m_limit) || *m_cur != skip)
       return 1;					/* Didn't find char */
     m_cur++;
     return 0;
@@ -72,4 +72,5 @@ protected:
   const char *m_cur;
   const char *m_limit;
   char *m_err_msg;
+  CHARSET_INFO *m_charset;
 };

sql/item_geofunc.cc

@@ -31,10 +31,13 @@
 String *Item_func_geometry_from_text::val_str(String *str)
 {
   Geometry_buffer buffer;
-  Geometry *geom;
   String arg_val;
   String *wkt= args[0]->val_str(&arg_val);
-  Gis_read_stream trs(wkt->c_ptr(), wkt->length());
+
+  if ((null_value= args[0]->null_value))
+    return 0;
+
+  Gis_read_stream trs(wkt->charset(), wkt->ptr(), wkt->length());
   uint32 srid= 0;
 
   if ((arg_count == 2) && !args[1]->null_value)
@@ -44,8 +47,7 @@ String *Item_func_geometry_from_text::val_str(String *str)
     return 0;
   str->length(0);
   str->q_append(srid);
-  if ((null_value=(args[0]->null_value || 
-		   !(geom= Geometry::create_from_wkt(&buffer, &trs, str, 0)))))
+  if ((null_value= !Geometry::create_from_wkt(&buffer, &trs, str, 0)))
     return 0;
   return str;
 }

sql/item_strfunc.cc

@@ -2241,7 +2241,7 @@ String *Item_func_hex::val_str(String *str)
   return &tmp_value;
 }
 
-int inline hexchar_to_int(char c)
+inline int hexchar_to_int(char c)
 {
   if (c <= '9' && c >= '0')
     return c-'0';
@@ -2721,7 +2721,7 @@ String *Item_func_uuid::val_str(String *str)
   {
     ulong tmp=sql_rnd_with_mutex();
     uchar mac[6];
-    int i;
+    unsigned int i;
     if (my_gethwaddr(mac))
     {
       /*

sql/spatial.h

@@ -157,7 +157,7 @@ struct Geometry_buffer;
 class Geometry
 {
 public:
-  static void *operator new(unsigned size_t, void *buffer)
+  static void *operator new(size_t size, void *buffer)
   {
     return buffer;
   }