# Fixes Solaris bug #15688738
# ===========================
--- sql/spatial.h revid:[email protected]
+++ sql/spatial.h 2013-06-26 05:14:10 +0000
@@ -324,6 +324,26 @@
{
return (cur_data + data_amount > m_data_end);
}
+
+ /**
+ Check if there're enough points remaining as requested
+
+ Need to perform the calculation in logical units, since multiplication
+ can overflow the size data type.
+
+ @arg data pointer to the begining of the points array
+ @arg expected_points number of points expected
+ @arg extra_point_space extra space for each point element in the array
+ @return true if there are not enough points
+ */
+ inline bool not_enough_points(const char *data, uint32 expected_points,
+ uint32 extra_point_space = 0) const
+ {
+ return (m_data_end < data ||
+ (expected_points > ((m_data_end - data) /
+ (POINT_DATA_SIZE + extra_point_space))));
+ }
+
const char *m_data;
const char *m_data_end;
};
=== modified file 'sql/spatial.cc'
--- sql/spatial.cc revid:[email protected]
+++ sql/spatial.cc 2013-06-26 05:14:10 +0000
@@ -393,7 +393,7 @@
points= uint4korr(data);
data+= 4;
- if (no_data(data, (SIZEOF_STORED_DOUBLE * 2 + offset) * points))
+ if (not_enough_points(data, points, offset))
return 0;
/* Calculate MBR for points */
@@ -476,9 +476,16 @@
uint32 Gis_line_string::get_data_size() const
{
+ size_t n_points;
if (no_data(m_data, 4))
return GET_SIZE_ERROR;
- return 4 + uint4korr(m_data) * POINT_DATA_SIZE;
+
+ n_points= uint4korr(m_data);
+
+ if (not_enough_points(m_data + 4, n_points))
+ return GET_SIZE_ERROR;
+
+ return 4 + n_points * POINT_DATA_SIZE;
}
@@ -548,7 +555,7 @@
data += 4;
if (n_points < 1 ||
- no_data(data, SIZEOF_STORED_DOUBLE * 2 * n_points) ||
+ not_enough_points(data, n_points) ||
txt->reserve(((MAX_DIGITS_IN_DOUBLE + 1)*2 + 1) * n_points))
return 1;
@@ -585,7 +592,7 @@
return 1;
n_points= uint4korr(data);
data+= 4;
- if (n_points < 1 || no_data(data, SIZEOF_STORED_DOUBLE * 2 * n_points))
+ if (n_points < 1 || not_enough_points(data, n_points))
return 1;
get_point(&prev_x, &prev_y, data);
@@ -619,7 +626,7 @@
return 0;
}
data+= 4;
- if (no_data(data, SIZEOF_STORED_DOUBLE * 2 * n_points))
+ if (n_points == 0 || not_enough_points(data, n_points))
return 1;
/* Get first point */
@@ -690,9 +697,16 @@
while (n_linear_rings--)
{
+ size_t n_points;
if (no_data(data, 4))
return GET_SIZE_ERROR;
- data+= 4 + uint4korr(data)*POINT_DATA_SIZE;
+ n_points= uint4korr(data);
+ data+= 4;
+
+ if (not_enough_points(data, n_points))
+ return GET_SIZE_ERROR;
+
+ data+= n_points * POINT_DATA_SIZE;
}
return (uint32) (data - m_data);
}
@@ -786,8 +800,9 @@
return 1;
n_points= uint4korr(data);
data+= 4;
- if (no_data(data, (SIZEOF_STORED_DOUBLE*2) * n_points) ||
- txt->reserve(2 + ((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points))
+
+ if (not_enough_points(data, n_points) ||
+ txt->reserve(2 + ((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points))
return 1;
txt->qs_append('(');
data= append_points(txt, n_points, data, 0);
@@ -840,7 +855,7 @@
if (no_data(data, 4))
return 1;
n_points= uint4korr(data);
- if (no_data(data, (SIZEOF_STORED_DOUBLE*2) * n_points))
+ if (not_enough_points(data, n_points))
return 1;
get_point(&prev_x, &prev_y, data+4);
data+= (4+SIZEOF_STORED_DOUBLE*2);
@@ -876,7 +891,7 @@
n_points= uint4korr(data);
data+= 4;
length= n_points * POINT_DATA_SIZE;
- if (no_data(data, length) || result->reserve(1+4+4+ length))
+ if (not_enough_points(data, n_points) || result->reserve(1+4+4+ length))
return 1;
result->q_append((char) wkb_ndr);
@@ -922,7 +937,7 @@
n_points= uint4korr(data);
points_size= n_points * POINT_DATA_SIZE;
data+= 4;
- if (no_data(data, points_size) || result->reserve(1+4+4+ points_size))
+ if (not_enough_points(data, n_points) || result->reserve(1+4+4+ points_size))
return 1;
result->q_append((char) wkb_ndr);
@@ -964,7 +979,7 @@
return 1;
org_n_points= n_points= uint4korr(data);
data+= 4;
- if (no_data(data, (SIZEOF_STORED_DOUBLE*2) * n_points))
+ if (not_enough_points(data, n_points))
return 1;
get_point(&prev_x, &prev_y, data);
data+= (SIZEOF_STORED_DOUBLE*2);
@@ -1021,14 +1036,21 @@
/***************************** MultiPoint *******************************/
-uint32 Gis_multi_point::get_data_size() const
+uint32 Gis_multi_point::get_data_size() const
{
+ size_t n_points;
+
if (no_data(m_data, 4))
return GET_SIZE_ERROR;
- return 4 + uint4korr(m_data)*(POINT_DATA_SIZE + WKB_HEADER_SIZE);
+
+ n_points= uint4korr(m_data);
+
+ if (not_enough_points(m_data + 4, n_points, WKB_HEADER_SIZE))
+ return GET_SIZE_ERROR;
+
+ return 4 + n_points * (POINT_DATA_SIZE + WKB_HEADER_SIZE);
}
-
bool Gis_multi_point::init_from_wkt(Gis_read_stream *trs, String *wkb)
{
uint32 n_points= 0;
@@ -1085,24 +1107,26 @@
return proper_size;
}
-
bool Gis_multi_point::get_data_as_wkt(String *txt, const char **end) const
{
uint32 n_points;
- if (no_data(m_data, 4))
+ const char *data= m_data;
+
+ if (no_data(data, 4))
return 1;
- n_points= uint4korr(m_data);
- if (no_data(m_data+4,
- n_points * (SIZEOF_STORED_DOUBLE * 2 + WKB_HEADER_SIZE)) ||
+ n_points= uint4korr(data);
+ data+= 4;
+
+ if (not_enough_points(data, n_points, WKB_HEADER_SIZE) ||
txt->reserve(((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points))
return 1;
- *end= append_points(txt, n_points, m_data+4, WKB_HEADER_SIZE);
- txt->length(txt->length()-1); // Remove end ','
+
+ *end= append_points(txt, n_points, data, WKB_HEADER_SIZE);
+ txt->length(txt->length()-1); // Remove end ','
return 0;
}
-
bool Gis_multi_point::get_mbr(MBR *mbr, const char **end) const
{
return (*end= get_mbr_for_points(mbr, m_data, WKB_HEADER_SIZE)) == 0;
@@ -1155,11 +1179,20 @@
while (n_line_strings--)
{
+ size_t n_points;
+
if (no_data(data, WKB_HEADER_SIZE + 4))
return GET_SIZE_ERROR;
- data+= (WKB_HEADER_SIZE + 4 + uint4korr(data + WKB_HEADER_SIZE) *
- POINT_DATA_SIZE);
+
+ n_points= uint4korr(data + WKB_HEADER_SIZE);
+ data+= WKB_HEADER_SIZE + 4;
+
+ if (not_enough_points(data, n_points))
+ return GET_SIZE_ERROR;
+
+ data+= n_points * POINT_DATA_SIZE;
}
+
return (uint32) (data - m_data);
}
@@ -1251,7 +1284,7 @@
return 1;
n_points= uint4korr(data + WKB_HEADER_SIZE);
data+= WKB_HEADER_SIZE + 4;
- if (no_data(data, n_points * (SIZEOF_STORED_DOUBLE*2)) ||
+ if (not_enough_points(data, n_points) ||
txt->reserve(2 + ((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points))
return 1;
txt->qs_append('(');
@@ -1312,7 +1345,7 @@
return 1;
n_points= uint4korr(data + WKB_HEADER_SIZE);
length= WKB_HEADER_SIZE + 4+ POINT_DATA_SIZE * n_points;
- if (no_data(data, length))
+ if (not_enough_points(data + WKB_HEADER_SIZE + 4, n_points))
return 1;
if (!--num)
break;
@@ -1410,9 +1443,16 @@
while (n_linear_rings--)
{
+ size_t n_points;
if (no_data(data, 4))
- return GET_SIZE_ERROR;
- data+= 4 + uint4korr(data) * POINT_DATA_SIZE;
+ return GET_SIZE_ERROR;
+ n_points= uint4korr(data);
+ data+= 4;
+
+ if (not_enough_points(data, n_points))
+ return GET_SIZE_ERROR;
+
+ data+= n_points * POINT_DATA_SIZE;
}
}
return (uint32) (data - m_data);
@@ -1512,7 +1552,7 @@
return 1;
uint32 n_points= uint4korr(data);
data+= 4;
- if (no_data(data, (SIZEOF_STORED_DOUBLE * 2) * n_points) ||
+ if (not_enough_points(data, n_points) ||
txt->reserve(2 + ((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points,
512))
return 1;
=== modified file 'sql/spatial.h'