Bug #33750 buffer overflow on reading a BIT(64) value using NDBAPI

Description:
When reading a BIT(64) using NdbOperation:getValue() 
an 8 byte buffer should be sufficient to store the result,
but actually 12 bytes are written to the buffer in this case.

A BIT(32) column result fits into 4 bytes as expected,
BIT(33) to BIT(63) fit into 8 bytes which is expected, too,
taking 4 byte alignments into account, but BIT(64) should
still fit into 8 bytes.

How to repeat:
See README in attached source project

test project

Attachment: csc22154-0.1.tar.gz (application/x-gzip, text), 300.42 KiB.

Workaround: use larger buffer

Proposed patch for Bug 33750

Attachment: bug33750.patch (text/x-patch), 23.51 KiB.

i think you could assert that len > 0
otherwise looks great
how much has run-time of testBitfield increased ?

Modified patch with len==0 case changed to assert and increased test iterations

Attachment: bug33750-v2.patch (text/x-patch), 24.11 KiB.

Runtime of testBitfield.cpp increased from ~13s to ~19s by this patch.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/41137

ChangeSet@1.2584, 2008-01-23 09:22:26+01:00, jonas@perch.ndb.mysql.com +3 -0
  ndb - bug#33750
    make sure that getField does not write after supplied buffer

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/41138

ChangeSet@1.2409, 2008-01-23 09:59:06+01:00, jonas@perch.ndb.mysql.com +3 -0
  ndb - bug#33750
      make sure that getField does not write after supplied buffer
      (recommit to correct clone, for easy merging)

pushed into 50-ndb, telco-61, telco-62, telco-63
51-telco-gca & 50-telco-gca

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/41150

ChangeSet@1.2187, 2008-01-23 13:50:17+01:00, jonas@perch.ndb.mysql.com +3 -0
  ndb - bug#33750 (drop6)
    make sure that getField does not write after supplied buffer

Documented bugfix in 5.1.23-ndb-6.3.8 changelog as follows:

      
        When reading a BIT(64) value using
        NdbOperation:getValue(), 12 bytes are written
        to the buffer rather than the expected 8 bits.
      
Left bug in PQ status mending additional merges.

Also documented for 5.1.23-ndb-6.2.11; left status unchanged.

Pushed into 5.0.58

Pushed into 5.1.24-rc

Pushed into 6.0.5-alpha

Also documented for 5.0.58, 5.1.24, and 6.0.5.