hcq/oceanbase
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix stack-use-after-scope core when bit cast to string

Browse Source
This commit is contained in:
br0
2021-10-22 10:27:40 +08:00
committed by LINxiansheng
parent db025266d4
commit 6de26d626e
1 changed files with 6 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/share/object/ob_obj_cast.cpp
View File

@ -4584,8 +4584,6 @@ static int bit_string(
int ret = OB_SUCCESS; int ret = OB_SUCCESS;
uint64_t value = in.get_bit(); uint64_t value = in.get_bit();
ObLength res_length = -1; ObLength res_length = -1;
char *res_buf;
int32_t bytes_length = 0;
if (OB_UNLIKELY((ObBitTC != in.get_type_class() || if (OB_UNLIKELY((ObBitTC != in.get_type_class() ||
(ObStringTC != ob_obj_type_class(expect_type) && ObTextTC != ob_obj_type_class(expect_type))))) { (ObStringTC != ob_obj_type_class(expect_type) && ObTextTC != ob_obj_type_class(expect_type))))) {
ret = OB_ERR_UNEXPECTED; ret = OB_ERR_UNEXPECTED;
@ -4600,9 +4598,8 @@ static int bit_string(
params.dest_collation_, params.dest_collation_,
params))) { params))) {
LOG_WARN("fail to convert string collation", K(ret)); LOG_WARN("fail to convert string collation", K(ret));
} else { } else if (OB_FAIL(copy_string(params, expect_type, tmp_str.ptr(), tmp_str.length(), out))) {
res_buf = tmp_str.ptr(); LOG_WARN("fail to copy string", KP(tmp_str.ptr()), K(tmp_str.length()), K(value), K(out), K(expect_type));
bytes_length = tmp_str.length();
} }
} else { } else {
// using bit as char array to do cast. // using bit as char array to do cast.
@ -4613,18 +4610,13 @@ static int bit_string(
MEMSET(tmp_buf, 0, BUF_LEN); MEMSET(tmp_buf, 0, BUF_LEN);
if (OB_FAIL(bit_to_char_array(value, scale, tmp_buf, BUF_LEN, pos))) { if (OB_FAIL(bit_to_char_array(value, scale, tmp_buf, BUF_LEN, pos))) {
LOG_WARN("fail to store val", KP(tmp_buf), K(BUF_LEN), K(value), K(pos)); LOG_WARN("fail to store val", KP(tmp_buf), K(BUF_LEN), K(value), K(pos));
} else { } else if (OB_FAIL(copy_string(params, expect_type, tmp_buf, pos, out))) {
res_buf = tmp_buf; LOG_WARN("fail to copy string", KP(tmp_buf), K(pos), K(value), K(out), K(expect_type));
bytes_length = pos;
} }
} }
if (OB_SUCC(ret)) { if (OB_SUCC(ret)) {
if (OB_FAIL(copy_string(params, expect_type, res_buf, bytes_length, out))) { res_length = static_cast<ObLength>(out.get_string_len());
LOG_WARN("fail to copy string", KP(res_buf), K(bytes_length), K(value), K(out), K(expect_type)); SET_RES_ACCURACY(DEFAULT_PRECISION_FOR_STRING, DEFAULT_SCALE_FOR_STRING, res_length);
} else {
res_length = static_cast<ObLength>(out.get_string_len());
SET_RES_ACCURACY(DEFAULT_PRECISION_FOR_STRING, DEFAULT_SCALE_FOR_STRING, res_length);
}
} }
return ret; return ret;
} }