diff --git a/mysql-test/main/gis.result b/mysql-test/main/gis.result index 0fe92b2f50c13..d60f8da2d5d51 100644 --- a/mysql-test/main/gis.result +++ b/mysql-test/main/gis.result @@ -5644,4 +5644,13 @@ NULL SELECT ST_GEOMFROMWKB (0x01050000000100000082040000000100000000000000000000000000000000000000) as g; g NULL +# +# MDEV-40552 UBSAN : load of value X, which is not a valid value for type 'wkbByteOrder' Gis_multi_point::init_from_wkb +# +SELECT ST_GEOMFROMWKB (0x0104000000010000000201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo; +multipoint_bad_inner_bo +NULL +SELECT ST_GEOMFROMWKB (0x0104000000010000008201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo; +multipoint_bad_inner_bo +NULL # End of 10.11 tests diff --git a/mysql-test/main/gis.test b/mysql-test/main/gis.test index 609c1509396f5..1efed8d076903 100644 --- a/mysql-test/main/gis.test +++ b/mysql-test/main/gis.test @@ -3605,4 +3605,11 @@ SELECT ST_GEOMFROMWKB (0x01070000000100000082010000000000000000000000) as g; SELECT ST_GEOMFROMWKB (0x01050000000100000002040000000100000000000000000000000000000000000000) as g; SELECT ST_GEOMFROMWKB (0x01050000000100000082040000000100000000000000000000000000000000000000) as g; +--echo # +--echo # MDEV-40552 UBSAN : load of value X, which is not a valid value for type 'wkbByteOrder' Gis_multi_point::init_from_wkb +--echo # + +SELECT ST_GEOMFROMWKB (0x0104000000010000000201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo; +SELECT ST_GEOMFROMWKB (0x0104000000010000008201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo; + --echo # End of 10.11 tests diff --git a/sql/spatial.cc b/sql/spatial.cc index 2de3c57ef1a11..979bac0954533 100644 --- a/sql/spatial.cc +++ b/sql/spatial.cc @@ -2180,6 +2180,8 @@ uint Gis_multi_point::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo, { res->q_append((char)wkb_ndr); res->q_append((uint32)wkb_point); + if ((uchar) wkb[0] > wkb_ndr) /* invalid */ + return 0; if (!p.init_from_wkb(wkb + WKB_HEADER_SIZE, POINT_DATA_SIZE, (wkbByteOrder) wkb[0], res)) return 0;