• Daniel Black's avatar
    MDEV-26350: select_lex->ref_pointer_array.size() % 5 == 0 · 0dec71ca
    Daniel Black authored
    Due to an integer overflow an invalid size of ref_pointer_array could be
    allocated.
    
    Using size_t allows this continue. Allocation failures are
    handled gracefully if the value is too big.
    
    Thanks to Zuming Jiang for the bug report and fuzzing MariaDB.
    
    Reviewer: Sanja
    0dec71ca
sql_lex.cc 147 KB