MDEV-17298 ASAN unknown-crash / READ of size 1 in my_strntoul_8bit up…

…on INSERT .. SELECT
MariaDB · Oct 31, 2018 · 75ceb6f · 75ceb6f
1 parent 09e9729
commit 75ceb6f
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 2 deletions.
diff --git a/mysql-test/r/ctype_latin1.result b/mysql-test/r/ctype_latin1.result
@@ -7963,5 +7963,14 @@ ABCDEFGHI-ABCDEFGHI
 DROP TABLE t1;
 SET optimizer_switch=@save_optimizer_switch;
 #
+# MDEV-17298 ASAN unknown-crash / READ of size 1 in my_strntoul_8bit upon INSERT .. SELECT
+#
+SET NAMES latin1;
+CREATE TABLE t1 (a CHAR);
+CREATE TABLE t2 (b ENUM('foo','bar'));
+INSERT INTO t1 VALUES ('1');
+INSERT INTO t2 SELECT * FROM t1;
+DROP TABLE t1, t2;
+#
 # End of 10.0 tests
 #
diff --git a/mysql-test/t/ctype_latin1.test b/mysql-test/t/ctype_latin1.test
@@ -264,6 +264,18 @@ SET NAMES latin1;
 --source include/ctype_mdev13118.inc
 
 
+--echo #
+--echo # MDEV-17298 ASAN unknown-crash / READ of size 1 in my_strntoul_8bit upon INSERT .. SELECT
+--echo #
+
+SET NAMES latin1;
+CREATE TABLE t1 (a CHAR);
+CREATE TABLE t2 (b ENUM('foo','bar'));
+INSERT INTO t1 VALUES ('1');
+INSERT INTO t2 SELECT * FROM t1;
+DROP TABLE t1, t2;
+
+
 --echo #
 --echo # End of 10.0 tests
 --echo #
diff --git a/strings/ctype-simple.c b/strings/ctype-simple.c
@@ -454,7 +454,6 @@ ulong my_strntoul_8bit(CHARSET_INFO *cs,
   register uint cutlim;
   register uint32 i;
   register const char *s;
-  register uchar c;
   const char *save, *e;
   int overflow;
 
@@ -489,8 +488,9 @@ ulong my_strntoul_8bit(CHARSET_INFO *cs,
   overflow = 0;
   i = 0;
 
-  for (c = *s; s != e; c = *++s)
+  for ( ; s != e; ++s)
   {
+    register uchar c= *s;
     if (c>='0' && c<='9')
       c -= '0';
     else if (c>='A' && c<='Z')