dict0dict.c:

  Fix bug introduced in 4.0.13 and reported by Emic: if a CREATE TABLE ended in a comment, a memory overrun could happen

innobase/dict/dict0dict.c

@@ -2405,9 +2405,12 @@ dict_strip_comments(
 	ptr = str;
 
 	for (;;) {
+scan_more:
 		if (*sptr == '\0') {
 			*ptr = '\0';
 
+			ut_a(ptr <= str + strlen(sql_string));
+
 			return(str);
 		}
 		
@@ -2421,7 +2424,7 @@ dict_strip_comments(
 				    || *sptr == (char)0x0D
 				    || *sptr == '\0') {
 
-					break;
+					goto scan_more;
 				}
 
 				sptr++;
@@ -2435,12 +2438,12 @@ dict_strip_comments(
 
 				     	sptr += 2;
 
-					break;
+					goto scan_more;
 				}
 
 				if (*sptr == '\0') {
 
-					break;
+					goto scan_more;
 				}
 
 				sptr++;