BUG#22291765 INSERT A TOKEN OF 84 4-BYTES CHARS INTO FTS INDEX

Shaohua Wang · Shaohua Wang · commit 707e6077e51d · 2015-12-03T10:14:14.000+08:00
CAUSES SERVER CRASH

we allow max token size up to 84 in both MyISAM and InnoDB, but
we suppose max multiple-bytes char length is 3 bytes, which is
not true. We support 4 bytes chars, e.g. in utf8mb4. So inserting
a token of 84 4-bytes chars will cause server crash.

Reviewed-by: Jimmy Yang &lt;jimmy.yang@oracle.com&gt;
Reviewed-by: Xing Zhang &lt;xing.z.zhang@oracle.com&gt;
RB: 11210
diff --git a/include/ft_global.h b/include/ft_global.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -25,8 +25,8 @@
 extern "C" {
 #endif
 
-#define HA_FT_MAXBYTELEN 254
-#define HA_FT_MAXCHARLEN (HA_FT_MAXBYTELEN/3)
+#define HA_FT_MAXBYTELEN 336
+#define HA_FT_MAXCHARLEN (HA_FT_MAXBYTELEN/4)
 
 #define DEFAULT_FTB_SYNTAX "+ -><()~*:\"\"&|"
 
diff --git a/storage/innobase/fts/fts0opt.cc b/storage/innobase/fts/fts0opt.cc
@@ -580,7 +580,7 @@ fts_zip_read_word(
 #ifdef UNIV_DEBUG
 	ulint		i;
 #endif
-	byte		len = 0;
+	short		len = 0;
 	void*		null = NULL;
 	byte*		ptr = word->f_str;
 	int		flush = Z_NO_FLUSH;
@@ -590,7 +590,7 @@ fts_zip_read_word(
 		return(NULL);
 	}
 
-	zip->zp->next_out = &len;
+	zip->zp->next_out = reinterpret_cast<byte*>(&len);
 	zip->zp->avail_out = sizeof(len);
 
 	while (zip->status == Z_OK && zip->zp->avail_out > 0) {
@@ -688,11 +688,12 @@ fts_fetch_index_words(
 	fts_zip_t*	zip = static_cast<fts_zip_t*>(user_arg);
 	que_node_t*	exp = sel_node->select_list;
 	dfield_t*	dfield = que_node_get_val(exp);
-	byte		len = (byte) dfield_get_len(dfield);
+	short		len =  static_cast<short>(dfield_get_len(dfield));
 	void*		data = dfield_get_data(dfield);
 
 	/* Skip the duplicate words. */
-	if (zip->word.f_len == len && !memcmp(zip->word.f_str, data, len)) {
+	if (zip->word.f_len == static_cast<ulint>(len)
+	    && !memcmp(zip->word.f_str, data, len)) {
 
 		return(TRUE);
 	}
@@ -706,7 +707,7 @@ fts_fetch_index_words(
 	ut_a(zip->zp->next_in == NULL);
 
 	/* The string is prefixed by len. */
-	zip->zp->next_in = &len;
+	zip->zp->next_in = reinterpret_cast<byte*>(&len);
 	zip->zp->avail_in = sizeof(len);
 
 	/* Compress the word, create output blocks as necessary. */
