• Tor Didriksen's avatar
    Bug #11792200 - DIVIDING LARGE NUMBERS CAUSES STACK CORRUPTIONS · ef19b3b6
    Tor Didriksen authored
    This was a buffer overrun in do_div_mod(), overwriting the internal buffer
    of auto variable 'tmp' in Item_func_int_div::val_int.
    Result on windows: 'this' is set to zero, and crash.
    Ran fine on other platforms (no valgrind warnings),
    but this is undefined behaviour on any platform of course.
    
    include/decimal.h:
      Add const qualifiers to function prototypes which are used by sql/my_decimal.h
    mysql-test/r/func_math.result:
      New test case.
    mysql-test/t/func_math.test:
      New test case.
    sql/my_decimal.h:
      Remove several C-style casts:
       - some of the were up-casts, and thus un-necessary
       - some of them should have been const-casts, but it is better to make the
         underlying library functions in (decimal.[h|c]) const instead.
    strings/decimal.c:
      Check for buffer overrun in do_div_mod()
      Add const qualifiers to functions which are used by sql/my_decimal.h
    ef19b3b6
func_math.test 15.6 KB