Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Fix #434 ub/sigsegv when using strtod on non-terminated strings. Test…
… added.
- Loading branch information
Showing
with
108 additions
and 1 deletion.
- +12 −0 src/gtests_functions.cpp
- +9 −1 src/sphinxexpr.cpp
- +15 −0 src/sphinxutils.h
- +1 −0 test/test_362/model.bin
- +71 −0 test/test_362/test.xml
@@ -0,0 +1 @@ | ||
a:1:{i:0;a:1:{i:0;a:3:{s:8:"sphinxql";s:55:"SELECT id, CONTAINS(POLY2D(poly2d_attr),2,40) FROM test";s:10:"total_rows";i:2;s:4:"rows";a:2:{i:0;a:2:{s:2:"id";s:1:"1";s:34:"contains(poly2d(poly2d_attr),2,40)";s:1:"0";}i:1;a:2:{s:2:"id";s:1:"2";s:34:"contains(poly2d(poly2d_attr),2,40)";s:1:"0";}}}}} |
@@ -0,0 +1,71 @@ | ||
<?xml version="1.0" encoding="utf-8"?> | ||
<test> | ||
<name>asciiz edge effect on string attributes</name> | ||
|
||
<requires> | ||
<force-rt/> | ||
</requires> | ||
|
||
<config> | ||
indexer | ||
{ | ||
mem_limit = 16M | ||
} | ||
|
||
searchd | ||
{ | ||
<searchd_settings/> | ||
} | ||
|
||
source test | ||
{ | ||
type = mysql | ||
<sql_settings/> | ||
sql_query = SELECT * FROM test_table | ||
sql_attr_string = kk | ||
sql_attr_string = poly2d_attr | ||
} | ||
|
||
index test | ||
{ | ||
source = test | ||
path = <data_path/>/test | ||
} | ||
|
||
</config> | ||
|
||
<db_create> | ||
CREATE TABLE test_table | ||
( | ||
id INT NOT NULL, | ||
title VARCHAR(255) NOT NULL, | ||
kk VARCHAR(255) NOT NULL, | ||
poly2d_attr VARCHAR(255) NOT NULL | ||
); | ||
</db_create> | ||
|
||
<db_drop>DROP TABLE IF EXISTS test_table;</db_drop> | ||
|
||
<!-- Key point of the test: | ||
Since string attrs in blob are packed and NOT z-terminated, | ||
right after last byte of poly2d_attr of doc 1 will follow | ||
packed attr kk of doc2. Packing first write len of attr (50) and then | ||
the blob of string itself. | ||
Finally it lead to the fact that in the saved blob (at least of RAM-chunk in rt) | ||
will be raw byte sequence '1,2,3,4,4,6210 tenten ...'. | ||
Original version of POLY2D will catch it, and so, reveal that point (2,40) are | ||
in polygon (triangle) (1,2) (3,4) (4,6), because last point is parsed | ||
was (4,6210). | ||
--> | ||
|
||
<db_insert> | ||
INSERT INTO test_table ( id, title, kk, poly2d_attr ) VALUES | ||
( 1, 'ohai', 'eleventy', '1,2,3,4,4,6' ), | ||
( 2, 'ohai2', '10 tenten tententen tententen tententen tententen ', '1,2,3,4,4,6' ) | ||
</db_insert> | ||
|
||
<sphqueries> | ||
<sphinxql>SELECT id, CONTAINS(POLY2D(poly2d_attr),2,40) FROM test</sphinxql> | ||
</sphqueries> | ||
|
||
</test> |