Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27480

Functions don't validate arguments properly and cast/truncate values without warnings or errors

    XMLWordPrintable

Details

    • Bug
    • Status: Stalled (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.2, 10.3, 10.4, 10.5, 10.6, 10.7
    • 10.11
    • Server
    • None

    Description

      Since CRC32(par, expr) and CRC32C(par, expr) presume the par part to be an already calculated CRC32 value, it has to be a 32-bit unsigned integer. However, they don't check it to be in the range, they just either truncate or roll over all other numeric values silently, without warnings or errors:

      preview-10.8-MDEV-27265-misc 3d04e67d

      MariaDB [(none)]> select crc32(4294967296,'');
      +----------------------+
      | crc32(4294967296,'') |
      +----------------------+
      |                    0 |
      +----------------------+
      1 row in set (0.001 sec)
      

      MariaDB [(none)]> select crc32(1e100,'');
      +-----------------+
      | crc32(1e100,'') |
      +-----------------+
      |      4294967295 |
      +-----------------+
      1 row in set (0.001 sec)
      

      MariaDB [(none)]> select crc32(10.11,'');
      +-----------------+
      | crc32(10.11,'') |
      +-----------------+
      |              10 |
      +-----------------+
      1 row in set (0.001 sec)
      

      MariaDB [(none)]> select crc32(-1,'');
      +--------------+
      | crc32(-1,'') |
      +--------------+
      |   4294967295 |
      +--------------+
      1 row in set (0.001 sec)
      

      It does however validate it to be numeric, so the behavior is at least inconsistent.

      MariaDB [(none)]> select crc32('','');
      +--------------+
      | crc32('','') |
      +--------------+
      |            0 |
      +--------------+
      1 row in set, 1 warning (0.001 sec)
       
      MariaDB [(none)]> show warnings;
      +---------+------+---------------------------------------+
      | Level   | Code | Message                               |
      +---------+------+---------------------------------------+
      | Warning | 1292 | Truncated incorrect INTEGER value: '' |
      +---------+------+---------------------------------------+
      1 row in set (0.000 sec)
      

      Attachments

        Issue Links

          Activity

            People

              elenst Elena Stepanova
              elenst Elena Stepanova
              Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.