@@ -1476,22 +1476,25 @@ uint maria_multi_check(THD *thd, char *packet, uint packet_length)
1476
1476
DBUG_ENTER (" maria_multi_check" );
1477
1477
while (packet_length)
1478
1478
{
1479
+ char *packet_start= packet;
1480
+ size_t subpacket_length= net_field_length ((uchar **)&packet_start);
1481
+ uint length_length= packet_start - packet;
1479
1482
// length of command + 3 bytes where that length was stored
1480
- uint subpacket_length= ( uint3korr ( packet) + 3 );
1481
- DBUG_PRINT ( " info " , ( " sub-packet length: %d command: %x " ,
1482
- subpacket_length, packet [3 ]));
1483
+ DBUG_PRINT ( " info " , ( " sub- packet length: %ld + %d command: %x " ,
1484
+ (ulong)subpacket_length, length_length ,
1485
+ packet_start [3 ]));
1483
1486
1484
- if (subpacket_length == 3 ||
1485
- subpacket_length > packet_length)
1487
+ if (subpacket_length == 0 ||
1488
+ ( subpacket_length + length_length) > packet_length)
1486
1489
{
1487
1490
my_message (ER_UNKNOWN_COM_ERROR, ER_THD (thd, ER_UNKNOWN_COM_ERROR),
1488
1491
MYF (0 ));
1489
1492
DBUG_RETURN (0 );
1490
1493
}
1491
1494
1492
1495
counter++;
1493
- packet+= subpacket_length;
1494
- packet_length-= subpacket_length;
1496
+ packet= packet_start + subpacket_length;
1497
+ packet_length-= ( subpacket_length + length_length) ;
1495
1498
}
1496
1499
DBUG_RETURN (counter);
1497
1500
}
@@ -2231,8 +2234,10 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
2231
2234
break ;
2232
2235
2233
2236
{
2237
+ char *packet_start= packet;
2234
2238
/* We have to store next length because it will be destroyed by '\0' */
2235
- uint next_subpacket_length= uint3korr (packet);
2239
+ size_t next_subpacket_length= net_field_length ((uchar **)&packet_start);
2240
+ uint next_length_length= packet_start - packet;
2236
2241
unsigned char *readbuff= net->buff ;
2237
2242
2238
2243
if (net_allocate_new_packet (net, thd, MYF (0 )))
@@ -2246,22 +2251,28 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
2246
2251
while (packet_length)
2247
2252
{
2248
2253
current_com++;
2249
- uint subpacket_length= next_subpacket_length + 3 ;
2254
+ size_t subpacket_length= next_subpacket_length + next_length_length;
2255
+ uint length_length= next_length_length;
2250
2256
if (subpacket_length < packet_length)
2251
- next_subpacket_length= uint3korr (packet + subpacket_length);
2257
+ {
2258
+ packet_start= packet + subpacket_length;
2259
+ next_subpacket_length= net_field_length ((uchar**)&packet_start);
2260
+ next_length_length= packet_start - (packet + subpacket_length);
2261
+ }
2252
2262
/* safety like in do_command() */
2253
2263
packet[subpacket_length]= ' \0 ' ;
2254
2264
2255
- enum enum_server_command subcommand= fetch_command (thd, (packet + 3 ));
2265
+ enum enum_server_command subcommand=
2266
+ fetch_command (thd, (packet + length_length));
2256
2267
2257
2268
if (server_command_flags[subcommand] & CF_NO_COM_MULTI)
2258
2269
{
2259
2270
my_error (ER_BAD_COMMAND_IN_MULTI, MYF (0 ), command_name[subcommand]);
2260
2271
goto com_multi_end;
2261
2272
}
2262
2273
2263
- if (dispatch_command (subcommand, thd, packet + (1 + 3 ),
2264
- subpacket_length - (1 + 3 ), TRUE ,
2274
+ if (dispatch_command (subcommand, thd, packet + (1 + length_length ),
2275
+ subpacket_length - (1 + length_length ), TRUE ,
2265
2276
(current_com != counter)))
2266
2277
{
2267
2278
DBUG_ASSERT (thd->is_error ());
0 commit comments