Bug #16627 "Index and length must refer to a location within the string." when executing c
Submitted: 19 Jan 2006 11:49 Modified: 13 Apr 2006 12:49
Reporter: Christian Romberg
Status: No Feedback
Category:Connector/Net Severity:S1 (Critical)
Version:1.0.7 OS:
Assigned to: Reggie Burnett Target Version:

[19 Jan 2006 11:49] Christian Romberg
Description:
I've encountered a bug, that an exception "Index and length must refer to a location
within the string." occured when executing a command. 

The offending line is in MySqlString.cs: 

if (length > 0) 
v = v.Substring(0, length); 

where the check is missing whether "length" actually exceeds the length of "v". 

This is the case in my scenario, because I'm using Prepare() and length is set to 255,
although the actual passed string sometimes is shorter. 

Please note, I consider this a serious bug, because it seems, that the Prepare()
functionality is not usable at all.

When I prepare a statement, then I configure the length to some fixed value (e.g. 255)
and the strings actually passed might be shorter.

When I reuse the statement (thats the reason for me to prepare them) I don't reset the
length.

How to repeat:
Define a string parameter with a length of 255, prepare the command, execute the command
with a string shorter then 255

Suggested fix:
change MySqlString::Serialize as follows:

		internal override void Serialize(PacketWriter writer, bool binary, object value, int
length)
		{
			string v = value.ToString();
			if (length > 0 && v.Length > length)
				v = v.Substring(0, length);

			if (binary)
				writer.WriteLenString( v );
			else
				writer.WriteStringNoNull( "'" + EscapeString(v) + "'" );
		}
[13 Mar 2006 11:12] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/3762
[14 Apr 2006 1:00] Bugs System
No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".