• Nisha Gopalakrishnan's avatar
    BUG#18080920: CRASH; MY_REALLOC_STR DEREFERENCES NEGATIVE VALUE · 501de3a0
    Nisha Gopalakrishnan authored
                  INTO CLIENT_ERRORS ARRAY
                  
    Analysis:
    --------
    The client may crash while executing a statement due to
    the missing mapping of the server error to it's equivalent
    client error.
    
    When trying to reallocate memory for the packet buffer, if
    the system is out of memory or the packet buffer is large,
    the server errors 'ER_OUT_OF_RESOURCES' or 'ER_PACKET_TOO_LARGE'
    is returned respectively. The client error number calculated is
    negative and when trying to dereference the array of client 
    error messages with the calculated error number, the client
    crashes.
    
    Fix:
    ----
    Map the server error returned to it's equivalent client error
    prior to dereferencing the array of client error messages.
    
    Note: Test case is not added since it is difficult to simulate
    the error condition.
    501de3a0
libmysql.c 135 KB