From d4ccf905bef7eca6329e2f439ac9fa0610b3aa92 Mon Sep 17 00:00:00 2001 From: Tor Didriksen Date: Tue, 17 Sep 2013 12:43:34 +0200 Subject: [PATCH] Bug#16765410 FTS: STACK AROUND THE VARIABLE 'MYSTR' WAS CORRUPTED IN INNOBASE_STRNXFRM my_strnxfrm_win1250ch could write into dest[destlen] i.e. write a byte to the past-the-end of dest. --- strings/ctype-win1250ch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/strings/ctype-win1250ch.c b/strings/ctype-win1250ch.c index cbb1ad5e685..a8181afa776 100644 --- a/strings/ctype-win1250ch.c +++ b/strings/ctype-win1250ch.c @@ -500,7 +500,7 @@ static size_t my_strnxfrm_win1250ch(CHARSET_INFO * cs __attribute__((unused)), do { NEXT_CMP_VALUE(src, p, pass, value, (int)srclen); - if (totlen <= len) + if (totlen < len) dest[totlen] = value; totlen++; } while (value) ;