Commit e5f57a58 authored by Georgi Kodinov's avatar Georgi Kodinov

merge 5.0->5.0-security

parents 79a9bcae 1077c85f
This source diff could not be displayed because it is too large. You can view the blob instead.
......@@ -996,4 +996,11 @@ ERROR 42000: You have an error in your SQL syntax; check the manual that corresp
ALTER TABLE t2 ADD SPATIAL INDEX USING BTREE (col1);
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'USING BTREE (col1)' at line 1
DROP TABLE t2;
#
# BUG#51875: crash when loading data into geometry function polyfromwkb
#
SET @a=0x00000000030000000100000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
SET @a=0x00000000030000000000000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
End of 5.0 tests
......@@ -685,4 +685,14 @@ ALTER TABLE t2 ADD SPATIAL INDEX USING BTREE (col1);
DROP TABLE t2;
--echo #
--echo # BUG#51875: crash when loading data into geometry function polyfromwkb
--echo #
SET @a=0x00000000030000000100000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
SET @a=0x00000000030000000000000000000000000000000000144000000000000014400000000000001840000000000000184000000000000014400000000000001440;
SET @a=POLYFROMWKB(@a);
--echo End of 5.0 tests
......@@ -519,7 +519,7 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len,
n_points= wkb_get_uint(wkb, bo);
proper_length= 4 + n_points * POINT_DATA_SIZE;
if (len < proper_length || res->reserve(proper_length))
if (!n_points || len < proper_length || res->reserve(proper_length))
return 0;
res->q_append(n_points);
......@@ -737,7 +737,9 @@ uint Gis_polygon::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo,
if (len < 4)
return 0;
n_linear_rings= wkb_get_uint(wkb, bo);
if (!(n_linear_rings= wkb_get_uint(wkb, bo)))
return 0;
if (res->reserve(4, 512))
return 0;
wkb+= 4;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment