• Gleb Shchepa's avatar
    Bug #55424: convert_tz crashes when fed invalid data · ed736379
    Gleb Shchepa authored
    The CONVERT_TZ function crashes the server when the
    timezone argument is an empty SET field value.
    
    1) The CONVERT_TZ may find a timezone string in the
       tz_names hash.
    2) A string representation of the empty SET is a
       String of zero length with the NULL pointer.
    3) If the key argument length is zero, hash functions
       do comparison using the length of the record being
       compared against.
    
    I.e. a zero-length String buffer is an invalid
    argument for hash search functions, and if String
    points to NULL buffer, hashcmp() fails with SEGV
    accessing that memory.
    
    The my_tz_find function has been modified to
    treat empty Strings as invalid timezone values
    to skip unnecessary hash search.
    ed736379
timezone2.result 10.9 KB