Commit 6a113b21 authored by Ramil Kalimullin's avatar Ramil Kalimullin

Fix for bug #51875: crash when loading data into geometry function polyfromwkb

Check for number of line strings in the incoming polygon data (wkb) and
for number of points in the incoming linestring wkb.



mysql-test/r/gis.result:
  Fix for bug #51875: crash when loading data into geometry function polyfromwkb
    - test result.
mysql-test/t/gis.test:
  Fix for bug #51875: crash when loading data into geometry function polyfromwkb
    - test case.
sql/spatial.cc:
  Fix for bug #51875: crash when loading data into geometry function polyfromwkb
    - creating a polygon from wkb check for number of line strings,
    - creating a linestring from wkb check for number of line points.
parent 3bc7c508
...@@ -1057,4 +1057,11 @@ NULL ...@@ -1057,4 +1057,11 @@ NULL
SELECT Polygon(12345123,''); SELECT Polygon(12345123,'');
Polygon(12345123,'') Polygon(12345123,'')
NULL NULL
#
# BUG#51875: crash when loading data into geometry function polyfromwkb
#
SET @a=0x00000000030000000100000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
SET @a=0x00000000030000000000000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
End of 5.1 tests End of 5.1 tests
...@@ -722,4 +722,14 @@ SELECT Polygon(123451,''); ...@@ -722,4 +722,14 @@ SELECT Polygon(123451,'');
SELECT Polygon(1234512,''); SELECT Polygon(1234512,'');
SELECT Polygon(12345123,''); SELECT Polygon(12345123,'');
--echo #
--echo # BUG#51875: crash when loading data into geometry function polyfromwkb
--echo #
SET @a=0x00000000030000000100000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
SET @a=0x00000000030000000000000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
--echo End of 5.1 tests --echo End of 5.1 tests
...@@ -528,7 +528,7 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len, ...@@ -528,7 +528,7 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len,
n_points= wkb_get_uint(wkb, bo); n_points= wkb_get_uint(wkb, bo);
proper_length= 4 + n_points * POINT_DATA_SIZE; proper_length= 4 + n_points * POINT_DATA_SIZE;
if (len < proper_length || res->reserve(proper_length)) if (!n_points || len < proper_length || res->reserve(proper_length))
return 0; return 0;
res->q_append(n_points); res->q_append(n_points);
...@@ -746,7 +746,9 @@ uint Gis_polygon::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo, ...@@ -746,7 +746,9 @@ uint Gis_polygon::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo,
if (len < 4) if (len < 4)
return 0; return 0;
n_linear_rings= wkb_get_uint(wkb, bo); if (!(n_linear_rings= wkb_get_uint(wkb, bo)))
return 0;
if (res->reserve(4, 512)) if (res->reserve(4, 512))
return 0; return 0;
wkb+= 4; wkb+= 4;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment