• unknown's avatar
    Bug #26303: Reserve is not called before qs_append(). · 9e6a5959
    unknown authored
    This may lead to buffer overflow.
    The String::qs_append() function will append a string
    without checking if there's enough space.
    So qs_append() must be called beforehand to ensure 
    there's enough space in the buffer for the subsequent 
    qs_append() calls.
    Fixed Item_case_expr::print() to make sure there's
    enough space before appending data by adding a call to 
    String::reserve() to make sure qs_append() will have 
    enough space.
    
    
    mysql-test/r/sp-code.result:
      Bug #26303: test case
    mysql-test/t/sp-code.test:
      Bug #26303: test case
    sql/item.cc:
      Bug #26303: added a call to String::reserve() to
       make sure qs_append will have enough space
    sql/item.h:
      Bug #26303: m_case_expr_id made unsigned 
      because it's offset in an array.
    9e6a5959
sp-code.result 13.8 KB