Fixed memory overrun in mysql_tzinfo_to_sql

e2f44b07 · Michael Widenius · 7c80c8b7 · e2f44b07
Commit e2f44b07 authored May 26, 2011 by Michael Widenius
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

sql/tztime.cc sql/tztime.cc +2 -2

No files found.
--- a/sql/tztime.cc
+++ b/sql/tztime.cc
@@ -214,7 +214,7 @@ tz_load(const char *name, TIME_ZONE_INFO *sp, MEM_ROOT *storage)
                                         ALIGN_SIZE(sp->typecnt *
                                                    sizeof(TRAN_TYPE_INFO)) +
 #ifdef ABBR_ARE_USED
-                                         ALIGN_SIZE(sp->charcnt) +
+                                         ALIGN_SIZE(sp->charcnt+1) +
 #endif
                                         sp->leapcnt * sizeof(LS_INFO))))
      return 1;
@@ -227,7 +227,7 @@ tz_load(const char *name, TIME_ZONE_INFO *sp, MEM_ROOT *storage)
    tzinfo_buf+= ALIGN_SIZE(sp->typecnt * sizeof(TRAN_TYPE_INFO));
 #ifdef ABBR_ARE_USED
    sp->chars= tzinfo_buf;
-    tzinfo_buf+= ALIGN_SIZE(sp->charcnt);
+    tzinfo_buf+= ALIGN_SIZE(sp->charcnt+1);
 #endif
    sp->lsis= (LS_INFO *)tzinfo_buf;