Commit 37fd497c authored by Alexander Barkov's avatar Alexander Barkov

MDEV-32458 ASAN unknown-crash in Inet6::ascii_to_fbt when casting character string to inet6

The condition checked the value of the leftmost byte before checking if
at least one byte is still available in the buffer.
Changing the order in the condition: check for a byte availability before
checking the byte value.
parent 2d2172a5
......@@ -2330,3 +2330,14 @@ Warning 1292 Incorrect inet6 value: ''
Warning 1292 Incorrect inet6 value: ''
Warning 1292 Incorrect inet6 value: ''
DROP TABLE t1;
#
# MDEV-32458 ASAN unknown-crash in Inet6::ascii_to_fbt when casting character string to inet6
#
CREATE TABLE t1 (c CHAR(3));
INSERT INTO t1 VALUES ('1:0'),('00:');
SELECT * FROM t1 WHERE c>CAST('::1' AS INET6);
c
Warnings:
Warning 1292 Incorrect inet6 value: '1:0'
Warning 1292 Incorrect inet6 value: '00:'
DROP TABLE t1;
......@@ -1686,3 +1686,13 @@ SELECT 1.00 + (b = a) AS f FROM t1 ORDER BY f;
SELECT 1.00 + (b BETWEEN a AND '') AS f FROM t1 ORDER BY f;
SELECT 1.00 + (b IN (a,'')) AS f FROM t1 ORDER BY f;
DROP TABLE t1;
--echo #
--echo # MDEV-32458 ASAN unknown-crash in Inet6::ascii_to_fbt when casting character string to inet6
--echo #
CREATE TABLE t1 (c CHAR(3));
INSERT INTO t1 VALUES ('1:0'),('00:');
SELECT * FROM t1 WHERE c>CAST('::1' AS INET6);
DROP TABLE t1;
......@@ -229,7 +229,7 @@ bool Inet6::ascii_to_ipv6(const char *str, size_t str_length)
continue;
}
if (!*p || p >= str_end)
if (p >= str_end || !*p)
{
DBUG_PRINT("error", ("ascii_to_ipv6(%.*s): invalid IPv6 address: "
"ending at ':'.", (int) str_length, str));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment