Bug #32034 check_func_enum() does not check correct values but set it to impossible int val
| Submitted: | 1 Nov 2007 15:54 | Modified: | 5 Dec 2007 18:57 |
|---|---|---|---|
| Reporter: | Oleksandr Byelkin | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server | Severity: | S2 (Serious) |
| Version: | 5.1 | OS: | Any (64bit) |
| Assigned to: | Gleb Shchepa | CPU Architecture: | Any |
[13 Nov 2007 21:00]
Gleb Shchepa
32bit Linux is not affected.
[13 Nov 2007 21:30]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/37705 ChangeSet@1.2648, 2007-11-14 01:29:17+04:00, gshchepa@gleb.loc +4 -0 Fixed bug #32034: On 64bit platforms assigning values of storage engine system variables was not validated and unexpected value was assigned. The check_func_enum function used subtraction from the uint value with the probably negative result. That result of type uint was compared with 0 after casting to signed long type. On architectures where long type is longer than int type the result of comparison was unexpected.
[14 Nov 2007 9:46]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/37731 ChangeSet@1.2648, 2007-11-14 13:48:21+04:00, gshchepa@gleb.loc +4 -0 Fixed bug #32034: On 64bit platforms assigning values of storage engine system variables was not validated and unexpected value was assigned. The check_func_enum function used subtraction from the uint value with the probably negative result. That result of type uint was compared with 0 after casting to signed long type. On architectures where long type is longer than int type the result of comparison was unexpected.
[16 Nov 2007 9:32]
Bugs System
Pushed into 5.1.23-rc
[16 Nov 2007 9:34]
Bugs System
Pushed into 6.0.4-alpha
[26 Nov 2007 18:57]
Paul DuBois
Noted in 5.1.23, 6.0.4 changelogs. On 64-bit platforms, assignments of values to storage engine-specific system variables were not validated and could result in unexpected values.
[26 Nov 2007 19:22]
Sergei Golubchik
storage engine-specific system variables of ENUM (one value from the set of strings) type
[5 Dec 2007 18:57]
Paul DuBois
Updated the changelog entries.
Portions of this website are copyright © 2001, 2002 The PHP Group
Page generated in 0.060 sec. using MySQL 8.4.7-u6-cloud
Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the
respective copyright holders.
It is not reviewed in advance
by Oracle and does not necessarily represent the opinion of
Oracle or any other party.
Description: Due to incorrect types casting check_func_enum() do not detect error code from ind_type(). How to repeat: Write engine with MYSQL_SYSVAR_ENUM() and assign incorrect value. Suggested fix: sql/sql_plugin.cc 1.75 vs edited ===== --- 1.75/sql/sql_plugin.cc 2007-10-08 22:00:21 +03:00 +++ edited/sql/sql_plugin.cc 2007-11-01 11:02:48 +02:00 @@ -1945,7 +1945,7 @@ length= sizeof(buff); if (!(str= value->val_str(value, buff, &length))) goto err; - if ((result= find_type(typelib, str, length, 1)-1) < 0) + if ((result= ((long)find_type(typelib, str, length, 1)) - 1) < 0) { strvalue= str; goto err;