• Kailasnath Nagarkar's avatar
    Bug #23296299 : HANDLE_FATAL_SIGNAL (SIG=11) IN · 07a33cdc
    Kailasnath Nagarkar authored
                    MY_TOSORT_UTF32
    
    This patch is specific for mysql-5.5
    
    ISSUE: When a charater that is larger than possible to
    handle is passed to function my_tosort_utf32(), it results
    in segmentation fault. In the scenario mentioned in the bug
    AES_ENCRYPT function is used which returns large value.
    This value is further passed to my_tosort_utf32 function.
    This causes to cross array bound for array uni_plane,
    resulting in segment violation.
    
    SOLUTION:
    This issue has got addressed in 5.6 onward releases
    through worklog 2673.
    
    The fix is similar backport of that.
    Check for maximum character before accessing the array
    uni_plane. In addition to function my_tosort_utf32, the
    same potential problem is also present in functions
    my_tolower_utf16, my_toupper_utf16, my_tosort_utf16,
    my_tolower_utf32, my_toupper_utf32, my_tosort_unicode,
    my_tolower_utf8mb4 and my_toupper_utf8mb4.
    Fixed these functions as well.
    07a33cdc
ctype-utf8.c 223 KB