Bug#16765410 FTS: STACK AROUND THE VARIABLE 'MYSTR' WAS CORRUPTED IN INNOBASE_STRNXFRM

Tor Didriksen · Tor Didriksen · commit 16fa82fdd596 · 2013-09-17T12:43:34.000+02:00
my_strnxfrm_win1250ch could write into dest[destlen]
i.e. write a byte to the past-the-end of dest.
diff --git a/strings/ctype-win1250ch.c b/strings/ctype-win1250ch.c
@@ -500,7 +500,7 @@ static size_t my_strnxfrm_win1250ch(CHARSET_INFO * cs  __attribute__((unused)),
 
   do {
     NEXT_CMP_VALUE(src, p, pass, value, (int)srclen);
-    if (totlen <= len)
+    if (totlen < len)
       dest[totlen] = value;
     totlen++;
   } while (value) ;
