CONC-619: NULL pointer dereference in unpack_fields

9EOR9 · 9EOR9 · commit a3bba4639f55 · 2023-05-02T17:59:18.000+02:00
Fixed NULL pointer dereference, thanks to Yury Chaikou which
reported this issue.
diff --git a/libmariadb/mariadb_lib.c b/libmariadb/mariadb_lib.c
@@ -891,7 +891,7 @@ unpack_fields(const MYSQL *mysql,
     for (i=0; i < field_count; i++)
     {
       uint length= (uint)(row->data[i+1] - row->data[i] - 1);
-      if (!row->data[i] && row->data[i][length])
+      if (!row->data[i] || row->data[i][length])
         goto error;
 
       *(char **)(((char *)field) + rset_field_offsets[i*2])=

Original file line number	Diff line number	Diff line change
`@@ -891,7 +891,7 @@ unpack_fields(const MYSQL *mysql,`
`891`	`891`	`for (i=0; i < field_count; i++)`
`892`	`892`	`{`
`893`	`893`	`uint length= (uint)(row->data[i+1] - row->data[i] - 1);`
`894`		`- if (!row->data[i] && row->data[i][length])`
	`894`	`+ if (!row->data[i] \|\| row->data[i][length])`
`895`	`895`	`goto error;`
`896`	`896`
`897`	`897`	`(char )(((char )field) + rset_field_offsets[i*2])=`