Skip to content
  • Alexander Barkov's avatar
    89ea26b0
    Bug#14100466 INVALID MEMORY READS IN GET_POINT · 89ea26b0
    Alexander Barkov authored
    Problem:
    uint32 multiplication overflow happened during
    calculation of proper_length in case of a big n_points value,
    so the condition "len < proper_length" did not detect out-of-range errors.
                
    Fix:
    Adding constants Gis_multi_point::max_n_points and
    Gis_line_string::max_n_points and checking that n_points
    value in the input WKB data do not exceed max_n_points.
    
    @ internal/mysql-test/suite/i_main/r/gis.result
    @ internal/mysql-test/suite/i_main/t/gis.test
      Adding tests
    
    @  sql/spatial.cc
      Returning on error if n_points value in the input WKB data
      exceeds max_n_points
    
    @  sql/spatial.h
      Adding declarations for
      Gis_multi_point::max_n_points and Gis_line_string::max_n_points
    89ea26b0
    Bug#14100466 INVALID MEMORY READS IN GET_POINT
    Alexander Barkov authored
    Problem:
    uint32 multiplication overflow happened during
    calculation of proper_length in case of a big n_points value,
    so the condition "len < proper_length" did not detect out-of-range errors.
                
    Fix:
    Adding constants Gis_multi_point::max_n_points and
    Gis_line_string::max_n_points and checking that n_points
    value in the input WKB data do not exceed max_n_points.
    
    @ internal/mysql-test/suite/i_main/r/gis.result
    @ internal/mysql-test/suite/i_main/t/gis.test
      Adding tests
    
    @  sql/spatial.cc
      Returning on error if n_points value in the input WKB data
      exceeds max_n_points
    
    @  sql/spatial.h
      Adding declarations for
      Gis_multi_point::max_n_points and Gis_line_string::max_n_points
Loading