[MariaDB commits] [PATCH] Fix stack overrun crash due to missing stack check in two recursive functions

[Kristian Nielsen via commits]

Signed-off-by: Kristian Nielsen <kniel...@knielsen-hq.org>
---
 sql/item.cc       | 6 +++++-
 sql/sql_select.cc | 6 ++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/sql/item.cc b/sql/item.cc
index 04b689f51af..1b244afdb8a 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -27,6 +27,7 @@
 #include "sp_rcontext.h"
 #include "sp_head.h"
 #include "sql_trigger.h"
+#include "sql_parse.h"
 #include "sql_select.h"
 #include "sql_show.h"                           // append_identifier
 #include "sql_view.h"                           // VIEW_ANY_SQL
@@ -485,7 +486,10 @@ void Item::print_parenthesised(String *str, 
enum_query_type query_type,
   bool need_parens= precedence() < parent_prec;
   if (need_parens)
     str->append('(');
-  print(str, query_type);
+  if (check_stack_overrun(current_thd, STACK_MIN_SIZE, NULL))
+    str->append("<STACK OVERRUN>");
+  else
+    print(str, query_type);
   if (need_parens)
     str->append(')');
 }
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index a871faec99e..68a83d9877e 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -17657,6 +17657,12 @@ Item_cond::remove_eq_conds(THD *thd, Item::cond_result 
*cond_value,
   bool and_level= functype() == Item_func::COND_AND_FUNC;
   List<Item> *cond_arg_list= argument_list();
 
+  if (check_stack_overrun(thd, STACK_MIN_SIZE, NULL))
+  {
+    *cond_value= Item::COND_FALSE;
+    return (COND*) 0;                           // Fatal error flag is set!
+  }
+
   if (and_level)
   {
     /*
-- 
2.30.2

_______________________________________________
commits mailing list -- commits@lists.mariadb.org
To unsubscribe send an email to commits-le...@lists.mariadb.org