Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41643

Temporal to_string() returns a String with unset length when allocation fails

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Minor
    • Resolution: Unresolved
    • 10.11
    • 10.11
    • Temporal Types
    • None

    Description

      The to_string() methods of Temporal_hybrid, Interval_DDhhmmssff, Time, Date and Datetime in sql/sql_type.h all have the same body:

      str->set_charset(&my_charset_numeric);
      if (!str->alloc(MAX_DATE_STRING_REP_LENGTH))
        str->length(my_TIME_to_str(this, const_cast<char*>(str->ptr()), dec));
      return str;

      When String::alloc() fails (out of memory) the length is not set, but str is still returned as success. The caller then uses a String whose buffer may be NULL and whose length is whatever it was before.

      Expected: return NULL on allocation failure, like the !is_valid_temporal() case.

      The body is copied five times and only the formatter differs, so it is worth factoring into one helper so that a fix cannot miss a copy.

      Present in 10.11 and later.

      Found during review of MDEV-25529 (https://github.com/MariaDB/server/pull/5294); the code predates that change.

      Attachments

        Issue Links

          Activity

            People

              midenok Aleksey Midenkov
              sanja Oleksandr Byelkin
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.