diff -ruN mariadb-native-client-2.0.0.old/libmariadb/libmariadb.c mariadb-native-client-2.0.0/libmariadb/libmariadb.c --- mariadb-native-client-2.0.0.old/libmariadb/libmariadb.c 2014-04-17 11:22:39.000000000 -0400 +++ mariadb-native-client-2.0.0/libmariadb/libmariadb.c 2014-05-14 08:19:34.601255183 -0400 @@ -1192,7 +1192,7 @@ sizeof(MYSQL_ROWS))) || !(cur->data= ((MYSQL_ROW) alloc_root(&result->alloc, - (fields+1)*sizeof(char *)+pkt_len)))) + (fields+1)*sizeof(MYSQL_ROW)+pkt_len+fields /* null terminated fields */)))) { free_rows(result); SET_CLIENT_ERROR(mysql, CR_OUT_OF_MEMORY, unknown_sqlstate, 0); @@ -1200,8 +1200,15 @@ } *prev_ptr=cur; prev_ptr= &cur->next; + /* NOTE, curr->data is an array of character pointers. The beginning + * of the data allocated is used as pointers to the location of + * the column data. These pointers point to the additional + * allocated memory that comes after these pointers that contain + * the actual column data. Each column is NULL terminated unless + * the column itself is NULL. + */ to= (char*) (cur->data+fields+1); - end_to=to+pkt_len-1; + end_to=to+pkt_len+fields-1; for (field=0 ; field < fields ; field++) { if ((len=(ulong) net_field_length(&cp)) == NULL_LENGTH)