From: Date: April 3 2008 8:12pm
Subject: bk commit into 5.0 tree (malff:1.2599) BUG#35658
List-Archive: http://lists.mysql.com/commits/44886
X-Bug: 35658
Message-Id: <20080403181258.E94322DC93@lambda.WEBLAB>

Below is the list of changes that have just been committed into a local
5.0 repository of malff.  When malff does a push these changes
will be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet@stripped, 2008-04-03 12:12:53-06:00, malff@stripped. +3 -0
  Bug#35658 (An empty binary value leads to mysqld crash)
  
  Before this fix, the following token
    b''
  caused the parser to crash when reading the binary value from the empty string.
  The crash was caused by:
    ptr+= max_length - 1;
  because max_length is unsigned and was 0, causing an overflow.
  
  With this fix, an empty binary literal b'' is parsed as a binary value 0,
  in Item_bin_string.

  mysql-test/r/varbinary.result@stripped, 2008-04-03 12:12:48-06:00, malff@stripped. +31 -0
    Bug#35658 (An empty binary value leads to mysqld crash)

  mysql-test/t/varbinary.test@stripped, 2008-04-03 12:12:49-06:00, malff@stripped. +28 -0
    Bug#35658 (An empty binary value leads to mysqld crash)

  sql/item.cc@stripped, 2008-04-03 12:12:49-06:00, malff@stripped. +18 -11
    Bug#35658 (An empty binary value leads to mysqld crash)

diff -Nrup a/mysql-test/r/varbinary.result b/mysql-test/r/varbinary.result
--- a/mysql-test/r/varbinary.result	2007-03-09 14:18:36 -07:00
+++ b/mysql-test/r/varbinary.result	2008-04-03 12:12:48 -06:00
@@ -78,3 +78,34 @@ alter table t1 modify a varchar(255);
 select length(a) from t1;
 length(a)
 6
+select 0b01000001;
+0b01000001
+A
+select 0x41;
+0x41
+A
+select b'01000001';
+b'01000001'
+A
+select x'41', 0+x'41';
+x'41'	0+x'41'
+A	65
+select N'abc', length(N'abc');
+abc	length(N'abc')
+abc	3
+select N'', length(N'');
+	length(N'')
+	0
+select '', length('');
+	length('')
+	0
+select b'', 0+b'';
+b''	0+b''
+	0
+select x'', 0+x'';
+x''	0+x''
+	0
+select 0x;
+ERROR 42S22: Unknown column '0x' in 'field list'
+select 0b;
+ERROR 42S22: Unknown column '0b' in 'field list'
diff -Nrup a/mysql-test/t/varbinary.test b/mysql-test/t/varbinary.test
--- a/mysql-test/t/varbinary.test	2006-12-21 16:38:31 -07:00
+++ b/mysql-test/t/varbinary.test	2008-04-03 12:12:49 -06:00
@@ -84,3 +84,31 @@ select length(a) from t1;
 alter table t1 modify a varchar(255);
 select length(a) from t1;
 
+#
+# Bug#35658 (An empty binary value leads to mysqld crash)
+#
+
+select 0b01000001;
+
+select 0x41;
+
+select b'01000001';
+
+select x'41', 0+x'41';
+
+select N'abc', length(N'abc');
+
+select N'', length(N'');
+
+select '', length('');
+
+select b'', 0+b'';
+
+select x'', 0+x'';
+
+--error ER_BAD_FIELD_ERROR
+select 0x;
+
+--error ER_BAD_FIELD_ERROR
+select 0b;
+
diff -Nrup a/sql/item.cc b/sql/item.cc
--- a/sql/item.cc	2008-03-27 10:05:49 -06:00
+++ b/sql/item.cc	2008-04-03 12:12:49 -06:00
@@ -4988,21 +4988,28 @@ Item_bin_string::Item_bin_string(const c
   if (!ptr)
     return;
   str_value.set(ptr, max_length, &my_charset_bin);
-  ptr+= max_length - 1;
-  ptr[1]= 0;                     // Set end null for string
-  for (; end >= str; end--)
+
+  if (max_length > 0)
   {
-    if (power == 256)
+    ptr+= max_length - 1;
+    ptr[1]= 0;                     // Set end null for string
+    for (; end >= str; end--)
     {
-      power= 1;
-      *ptr--= bits;
-      bits= 0;     
+      if (power == 256)
+      {
+        power= 1;
+        *ptr--= bits;
+        bits= 0;
+      }
+      if (*end == '1')
+        bits|= power;
+      power<<= 1;
     }
-    if (*end == '1')
-      bits|= power; 
-    power<<= 1;
+    *ptr= (char) bits;
   }
-  *ptr= (char) bits;
+  else
+    ptr[0]= 0;
+
   collation.set(&my_charset_bin, DERIVATION_COERCIBLE);
   fixed= 1;
 }