• Tor Didriksen's avatar
    Bug#12563865 ROUNDED,TMP_BUF,DECIMAL_VALUE STACK CORRUPTION IN ALL VERSIONS >=5.0 · d23912da
    Tor Didriksen authored
    Buffer over-run on all platforms, crash on windows, wrong result on other platforms,
    when rounding numbers which start with 999999999 and have
    precision = 9 or 18 or 27 or 36 ...
    
    
    mysql-test/r/type_newdecimal.result:
      New test cases.
    mysql-test/t/type_newdecimal.test:
      New test cases.
    sql/my_decimal.h:
      Add sanity checking code, to catch buffer over/under-run.
    strings/decimal.c:
      The original initialization of intg1 (add 1 if buf[0] == DIG_MAX)
      will set p1 to point outside the buffer, and the loop to copy the original value
          while (buf0 < p0)
            *(--p1) = *(--p0);
      will overwrite memory outside the my_decimal object.
    d23912da
decimal.c 85.9 KB