• evgen@moonbone.local's avatar
    Fixed bug#16752 Binary table files created in mysqld v4.1 caused buffer overrun · 3a3f8379
    evgen@moonbone.local authored
      and possibly server crash in mysqld v5.0.
    
    Reported MyISAM table was created in mysqld 4.1 and contains varchar field.
    When binary files of that table was moved to 5.0, mysqld treats that varchar 
    field as a string field. 
    In order to make grouping server calculates group buffer, and because
    that field is string server assumes it has fixed length and doesn't add
    space for length, but later that field is converted to varchar field. 
    Due to this, when field values were actually copied, additional space for
    length bytes is taken and buffer overrun occurs, which may lead to server crash.
    
    The calc_group_buffer() function now reserves additional space for length
    bytes for VAR_STRING fields, like for VARCHAR fields.
    3a3f8379
sql_select.cc 442 KB