bk commit into 4.1 tree (jimw:1.2315) BUG#11311

[Jim Winstead]

Below is the list of changes that have just been committed into a local
4.1 repository of jimw. When jimw does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet
  1.2315 05/06/24 09:19:09 jimw@stripped +2 -0
  Fix calculation for length of LPAD() and RPAD() reported to
  client via mysql_fetch_fields() and to avoid integer overflow
  issues. (Bug #11311)

  tests/mysql_client_test.c
    1.152 05/06/24 09:19:06 jimw@stripped +34 -0
    Add test for Bug #11311.

  sql/item_strfunc.cc
    1.227 05/06/24 09:19:06 jimw@stripped +17 -11
    Fix calculation of max_length of LPAD() and RPAD() to avoid
    integer overflow, and to set it correctly with a constant length --
    it is always exactly that length or MAX_BLOB_WIDTH.

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	jimw
# Host:	rama.(none)
# Root:	/home/jimw/my/mysql-4.1-11311

--- 1.226/sql/item_strfunc.cc	2005-06-05 10:38:40 -07:00
+++ 1.227/sql/item_strfunc.cc	2005-06-24 09:19:06 -07:00
@@ -2009,12 +2009,15 @@
   args[2]= cargs[1];
   if (args[1]->const_item())
   {
-    uint32 length= (uint32) args[1]->val_int() * collation.collation->mbmaxlen;
-    max_length=max(args[0]->max_length,length);
-    if (max_length >= MAX_BLOB_WIDTH)
+    longlong len= args[1]->val_int();
+    if (len > MAX_BLOB_WIDTH / collation.collation->mbmaxlen)
     {
-      max_length=MAX_BLOB_WIDTH;
-      maybe_null=1;
+      max_length= MAX_BLOB_WIDTH;
+      maybe_null= 1;
+    }
+    else
+    {
+      max_length= (uint32) len * collation.collation->mbmaxlen;
     }
   }
   else
@@ -2092,15 +2095,18 @@
     return;
   args[0]= cargs[0];
   args[2]= cargs[1];
-  
+
   if (args[1]->const_item())
   {
-    uint32 length= (uint32) args[1]->val_int() * collation.collation->mbmaxlen;
-    max_length=max(args[0]->max_length,length);
-    if (max_length >= MAX_BLOB_WIDTH)
+    longlong len= args[1]->val_int();
+    if (len > MAX_BLOB_WIDTH / collation.collation->mbmaxlen)
+    {
+      max_length= MAX_BLOB_WIDTH;
+      maybe_null= 1;
+    }
+    else
     {
-      max_length=MAX_BLOB_WIDTH;
-      maybe_null=1;
+      max_length= (uint32) len * collation.collation->mbmaxlen;
     }
   }
   else

--- 1.151/tests/mysql_client_test.c	2005-04-27 17:50:46 -07:00
+++ 1.152/tests/mysql_client_test.c	2005-06-24 09:19:06 -07:00
@@ -11619,6 +11619,39 @@
   DIE_UNLESS(!mysql_errno(mysql));
 }
 
+/*
+  Test that correct max field length is returned for LPAD().
+ */
+
+static void test_bug11311()
+{
+  int rc;
+  MYSQL_RES *res;
+  MYSQL_FIELD *fields;
+
+  rc= mysql_query(mysql, "DROP TABLE IF EXISTS t1");
+  myquery(rc);
+
+  rc= mysql_query(mysql, "CREATE TABLE t1 (i int)");
+  myquery(rc);
+
+  rc= mysql_query(mysql, "INSERT INTO t1 VALUES (1000000000)");
+  myquery(rc);
+
+  rc= mysql_query(mysql, "SELECT LPAD(i, 7, ' ') AS t FROM t1");
+  myquery(rc);
+
+  res= mysql_store_result(mysql);
+  mytest(res);
+
+  fields= mysql_fetch_fields(res);
+  DIE_UNLESS(fields);
+
+  DIE_UNLESS(fields[0].length == 7);
+
+  rc= mysql_query(mysql, "DROP TABLE t1");
+  myquery(rc);
+}
 
 /*
  Test mysql_real_escape_string() with gbk charset
@@ -11884,6 +11917,7 @@
   { "test_bug8330", test_bug8330 },
   { "test_bug7990", test_bug7990 },
   { "test_bug8378", test_bug8378 },
+  { "test_bug11311", test_bug11311 },
   { 0, 0 }
 };