Description:
When debuging Item_func_set_user_var object for retieving value in string format like 'p suv->get_string_value()' in gdb ,
sometime the printed string value is not the valaue as expected.
When we execute SQL statement "set @v='aa';", the value is correct. But executing SQL statement "set @v=repeat('a', 2);"
we will retieve a string with more characters.
After debuging into get_string_value, in branch
case STRING_RESULT:
{
if (!save_result.vstr) // Null value
ss << "";
else
ss << save_result.vstr->ptr();
break;
}
we found that save_result.vstr->ptr() is a NULL terminated string of executing "set @v='aa'" while "set @v=repeat('a', 2);"
isn't a NULL terminate.
So I guess that "set @v=repeat('a', 2);" build a string without filling NULL to the end.
Although funtion Item_func_set_user_var::get_string_value has nowhere to be called, I think this will be a potential risk.
How to repeat:
Execute SQL statement "set @v='aa';", and print the generated object in gdb mode.
Suggested fix:
Remove this function or use real length to build string value as below.
case STRING_RESULT:
{
if (!save_result.vstr) // Null value
ss << "";
else
{
string s(save_result.vstr->ptr(), save_result.vstr->length());
ss << s;
}
break;
}
Description: When debuging Item_func_set_user_var object for retieving value in string format like 'p suv->get_string_value()' in gdb , sometime the printed string value is not the valaue as expected. When we execute SQL statement "set @v='aa';", the value is correct. But executing SQL statement "set @v=repeat('a', 2);" we will retieve a string with more characters. After debuging into get_string_value, in branch case STRING_RESULT: { if (!save_result.vstr) // Null value ss << ""; else ss << save_result.vstr->ptr(); break; } we found that save_result.vstr->ptr() is a NULL terminated string of executing "set @v='aa'" while "set @v=repeat('a', 2);" isn't a NULL terminate. So I guess that "set @v=repeat('a', 2);" build a string without filling NULL to the end. Although funtion Item_func_set_user_var::get_string_value has nowhere to be called, I think this will be a potential risk. How to repeat: Execute SQL statement "set @v='aa';", and print the generated object in gdb mode. Suggested fix: Remove this function or use real length to build string value as below. case STRING_RESULT: { if (!save_result.vstr) // Null value ss << ""; else { string s(save_result.vstr->ptr(), save_result.vstr->length()); ss << s; } break; }