Skip to content

Commit 7b86fda

Browse files
committed
Fixed length of codding of COM_MULTI parts.
1 parent 6dfa1d3 commit 7b86fda

File tree

1 file changed

+24
-13
lines changed

1 file changed

+24
-13
lines changed

sql/sql_parse.cc

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1476,22 +1476,25 @@ uint maria_multi_check(THD *thd, char *packet, uint packet_length)
14761476
DBUG_ENTER("maria_multi_check");
14771477
while (packet_length)
14781478
{
1479+
char *packet_start= packet;
1480+
size_t subpacket_length= net_field_length((uchar **)&packet_start);
1481+
uint length_length= packet_start - packet;
14791482
// length of command + 3 bytes where that length was stored
1480-
uint subpacket_length= (uint3korr(packet) + 3);
1481-
DBUG_PRINT("info", ("sub-packet length: %d command: %x",
1482-
subpacket_length, packet[3]));
1483+
DBUG_PRINT("info", ("sub-packet length: %ld + %d command: %x",
1484+
(ulong)subpacket_length, length_length,
1485+
packet_start[3]));
14831486

1484-
if (subpacket_length == 3 ||
1485-
subpacket_length > packet_length)
1487+
if (subpacket_length == 0 ||
1488+
(subpacket_length + length_length) > packet_length)
14861489
{
14871490
my_message(ER_UNKNOWN_COM_ERROR, ER_THD(thd, ER_UNKNOWN_COM_ERROR),
14881491
MYF(0));
14891492
DBUG_RETURN(0);
14901493
}
14911494

14921495
counter++;
1493-
packet+= subpacket_length;
1494-
packet_length-= subpacket_length;
1496+
packet= packet_start + subpacket_length;
1497+
packet_length-= (subpacket_length + length_length);
14951498
}
14961499
DBUG_RETURN(counter);
14971500
}
@@ -2231,8 +2234,10 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
22312234
break;
22322235

22332236
{
2237+
char *packet_start= packet;
22342238
/* We have to store next length because it will be destroyed by '\0' */
2235-
uint next_subpacket_length= uint3korr(packet);
2239+
size_t next_subpacket_length= net_field_length((uchar **)&packet_start);
2240+
uint next_length_length= packet_start - packet;
22362241
unsigned char *readbuff= net->buff;
22372242

22382243
if (net_allocate_new_packet(net, thd, MYF(0)))
@@ -2246,22 +2251,28 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
22462251
while (packet_length)
22472252
{
22482253
current_com++;
2249-
uint subpacket_length= next_subpacket_length + 3;
2254+
size_t subpacket_length= next_subpacket_length + next_length_length;
2255+
uint length_length= next_length_length;
22502256
if (subpacket_length < packet_length)
2251-
next_subpacket_length= uint3korr(packet + subpacket_length);
2257+
{
2258+
packet_start= packet + subpacket_length;
2259+
next_subpacket_length= net_field_length((uchar**)&packet_start);
2260+
next_length_length= packet_start - (packet + subpacket_length);
2261+
}
22522262
/* safety like in do_command() */
22532263
packet[subpacket_length]= '\0';
22542264

2255-
enum enum_server_command subcommand= fetch_command(thd, (packet + 3));
2265+
enum enum_server_command subcommand=
2266+
fetch_command(thd, (packet + length_length));
22562267

22572268
if (server_command_flags[subcommand] & CF_NO_COM_MULTI)
22582269
{
22592270
my_error(ER_BAD_COMMAND_IN_MULTI, MYF(0), command_name[subcommand]);
22602271
goto com_multi_end;
22612272
}
22622273

2263-
if (dispatch_command(subcommand, thd, packet + (1 + 3),
2264-
subpacket_length - (1 + 3), TRUE,
2274+
if (dispatch_command(subcommand, thd, packet + (1 + length_length),
2275+
subpacket_length - (1 + length_length), TRUE,
22652276
(current_com != counter)))
22662277
{
22672278
DBUG_ASSERT(thd->is_error());

0 commit comments

Comments
 (0)