Skip to content
  • Chandan Kunal's avatar
    4b7a721f
    Bug #30441969: BUG #29723340: MYSQL SERVER CRASH AFTER SQL · 4b7a721f
    Chandan Kunal authored
                   QUERY WITH DATA ?AST
    
    Description:
    ============
    MySQL server ends abruptly when an Insert query is executed
    with specific value "1e-2147483648".
    
    ANALYSIS:
    =========
    Server ends abruptly when my_strntoull10_8bit is invoked to
    convert user provided string "1e-2147483648" to signed or
    unsigned long long integer value. In order to calculate the
    place of decimal it uses an "if" condition containing
    variable shift of int datatype and tries to negate it. But
    as value "-2147483648"(INT32_MIN) is minimum supported int
    value. so expression "-shift" will result into
    "-2147483648" as maximum int value supported is
    "2147483647"(INT32_MAX).
    
    SOLUTION:
    =========
    c++ function abs() is also useless to get the absolute
    value of this particular value so better to fix it by
    modifing the IF condition
        (-shift >= DIGITS_IN_ULONGLONG)
        to
        (shift == INT_MIN32 || -shift >= DIGITS_IN_ULONGLONG)
    
    Change-Id: I155ed2020f71b2b35fb4aa84ed3b3eb15883274b
    4b7a721f
    Bug #30441969: BUG #29723340: MYSQL SERVER CRASH AFTER SQL
    Chandan Kunal authored
                   QUERY WITH DATA ?AST
    
    Description:
    ============
    MySQL server ends abruptly when an Insert query is executed
    with specific value "1e-2147483648".
    
    ANALYSIS:
    =========
    Server ends abruptly when my_strntoull10_8bit is invoked to
    convert user provided string "1e-2147483648" to signed or
    unsigned long long integer value. In order to calculate the
    place of decimal it uses an "if" condition containing
    variable shift of int datatype and tries to negate it. But
    as value "-2147483648"(INT32_MIN) is minimum supported int
    value. so expression "-shift" will result into
    "-2147483648" as maximum int value supported is
    "2147483647"(INT32_MAX).
    
    SOLUTION:
    =========
    c++ function abs() is also useless to get the absolute
    value of this particular value so better to fix it by
    modifing the IF condition
        (-shift >= DIGITS_IN_ULONGLONG)
        to
        (shift == INT_MIN32 || -shift >= DIGITS_IN_ULONGLONG)
    
    Change-Id: I155ed2020f71b2b35fb4aa84ed3b3eb15883274b
Loading