MDEV-23149 Server crashes in my_convert / ErrConvString::ptr / Item_c…

…har_typecast::check_truncation_with_warn
MariaDB · Aug 10, 2022 · 82c07fc · 82c07fc
1 parent 47d0df6
commit 82c07fc
Show file tree

Hide file tree

Showing 5 changed files with 17 additions and 10 deletions.
diff --git a/mysql-test/main/func_compress.result b/mysql-test/main/func_compress.result
@@ -193,9 +193,6 @@ DROP TABLE t1;
 # End of 10.1 tests
 #
 #
-# Start of 10.2 tests
-#
-#
 # MDEV-10134 Add full support for DEFAULT
 #
 CREATE TABLE t1 (a TEXT, b BLOB DEFAULT COMPRESS(a), bl INT DEFAULT UNCOMPRESSED_LENGTH(b), a1 TEXT DEFAULT UNCOMPRESS(b));
@@ -213,5 +210,13 @@ bl	a1
 100	aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 DROP TABLE t1;
 #
+# MDEV-23149 Server crashes in my_convert / ErrConvString::ptr / Item_char_typecast::check_truncation_with_warn
+#
+select 'foo' in (cast(compress('bar') as char(4)), 'qux');
+'foo' in (cast(compress('bar') as char(4)), 'qux')
+0
+Warnings:
+Warning	1292	Truncated incorrect CHAR(4) value: '\x03\x00\x00\x00x\x9CKJ,\x02\x00\x02]\x016'
+#
 # End of 10.2 tests
 #
diff --git a/mysql-test/main/func_compress.test b/mysql-test/main/func_compress.test
@@ -173,10 +173,6 @@ DROP TABLE t1;
 --echo # End of 10.1 tests
 --echo #
 
---echo #
---echo # Start of 10.2 tests
---echo #
-
 --echo #
 --echo # MDEV-10134 Add full support for DEFAULT
 --echo #
@@ -186,6 +182,11 @@ INSERT INTO t1 (a) VALUES (REPEAT('a',100));
 SELECT bl, a1 FROM t1;
 DROP TABLE t1;
 
+--echo #
+--echo # MDEV-23149 Server crashes in my_convert / ErrConvString::ptr / Item_char_typecast::check_truncation_with_warn
+--echo #
+select 'foo' in (cast(compress('bar') as char(4)), 'qux');
+
 --echo #
 --echo # End of 10.2 tests
 --echo #
diff --git a/mysql-test/main/func_json.result b/mysql-test/main/func_json.result
@@ -765,8 +765,8 @@ DROP TABLE t1;
 #
 # MDEV-16054 simple json functions flatline cpu on garbage input.
 #
-select json_array(1,uuid(),compress(5.140264e+307));
-json_array(1,uuid(),compress(5.140264e+307))
+select json_array(1,user(),compress(5.140264e+307));
+json_array(1,user(),compress(5.140264e+307))
 NULL
 #
 # MDEV-16869 String functions don't respect character set of JSON_VALUE.

diff --git a/mysql-test/main/func_json.test b/mysql-test/main/func_json.test
@@ -429,7 +429,7 @@ DROP TABLE t1;
 --echo # MDEV-16054 simple json functions flatline cpu on garbage input.
 --echo #
 
-select json_array(1,uuid(),compress(5.140264e+307));
+select json_array(1,user(),compress(5.140264e+307));
 
 --echo #
 --echo # MDEV-16869 String functions don't respect character set of JSON_VALUE.

diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
@@ -4279,6 +4279,7 @@ String *Item_func_compress::val_str(String *str)
   }
 
   str->length((uint32)new_size + 4);
+  str->set_charset(&my_charset_bin);
   return str;
 }