Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
1.0.3
-
None
-
Centos 6.5
-
2016-19
Description
MariaDB's String object maintains a buffer that is frequently larger than the contained string. There is no null terminator in the buffer. The object maintains a separate length field.
There are places in ha_calpont_execplan.cpp where a String::ptr() is assigned directly to a std::string. This leads to the string potentially containing more characters than intended and of unknown values. The symptoms can be bad results or error messages to the user. String::c_ptr() should be substituted, as this translates the buffer into a null terminated string of the proper length.