Commit f70de145 authored by Weijun Huang's avatar Weijun Huang Committed by Daniel Black

MDEV-30351 crash in Item_func_left::val_str

When using LEFT() function with a string that is without a charset,
the function crashes. This is because the function assumes that
the string has a charset, and tries to use it to calculate the
length of the string.

Two functions, UNHEX and WEIGHT_STRING, returned a string without
the charset being set to a not null value.

The fix is to set charset when calling val_str on these two functions.
Reviewed-by: default avatarAlexander Barkov <bar@mariadb.com>
Reviewed-by: default avatarDaniel Black <daniel@mariadb.org>
parent a6780df4
......@@ -5240,6 +5240,15 @@ DROP TABLE crash_test_2;
# Start of 10.4 tests
#
#
# MDEV-30351 crash in Item_func_left::val_str
#
SELECT WEIGHT_STRING('aa') IN (LEFT(WEIGHT_STRING('aaa'),4),'bbb') as expect_1;
expect_1
1
SELECT UNHEX('0032') in (LEFT(UNHEX('003200'), 2),'dog') as expect_1;
expect_1
1
#
# MDEV-21841 CONV() function truncates the result type to 21 symbol.
#
CREATE TABLE t1(i BIGINT);
......
......@@ -2256,16 +2256,22 @@ CREATE TABLE crash_test_2 (
DROP TABLE t1;
DROP TABLE crash_test_2;
--echo #
--echo # End of 10.3 tests
--echo #
--echo #
--echo # Start of 10.4 tests
--echo #
--echo #
--echo # MDEV-30351 crash in Item_func_left::val_str
--echo #
SELECT WEIGHT_STRING('aa') IN (LEFT(WEIGHT_STRING('aaa'),4),'bbb') as expect_1;
SELECT UNHEX('0032') in (LEFT(UNHEX('003200'), 2),'dog') as expect_1;
--echo #
--echo # MDEV-21841 CONV() function truncates the result type to 21 symbol.
--echo #
......
......@@ -3729,6 +3729,7 @@ String *Item_func_weight_string::val_str(String *str)
flags);
DBUG_ASSERT(frm_length <= tmp_length);
str->set_charset(&my_charset_bin);
str->length(frm_length);
null_value= 0;
return str;
......@@ -3808,6 +3809,7 @@ String *Item_func_unhex::val_str(String *str)
from= res->ptr();
null_value= 0;
str->set_charset(&my_charset_bin);
str->length(length);
to= (char*) str->ptr();
if (res->length() % 2)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment