-
unknown authored
This may lead to buffer overflow. The String::qs_append() function will append a string without checking if there's enough space. So qs_append() must be called beforehand to ensure there's enough space in the buffer for the subsequent qs_append() calls. Fixed Item_case_expr::print() to make sure there's enough space before appending data by adding a call to String::reserve() to make sure qs_append() will have enough space. mysql-test/r/sp-code.result: Bug #26303: test case mysql-test/t/sp-code.test: Bug #26303: test case sql/item.cc: Bug #26303: added a call to String::reserve() to make sure qs_append will have enough space sql/item.h: Bug #26303: m_case_expr_id made unsigned because it's offset in an array.
9e6a5959