diff --git a/src/dsql/ExprNodes.cpp b/src/dsql/ExprNodes.cpp index 85424f0e100..4a3f3ab3eff 100644 --- a/src/dsql/ExprNodes.cpp +++ b/src/dsql/ExprNodes.cpp @@ -8061,6 +8061,11 @@ ValueExprNode* LiteralNode::dsqlPass(DsqlCompilerScratch* dsqlScratch) constant->litDesc.setTextType(sym->intlsym_ttype); } + // dsqlDesc needs dsc_length to be adjusted to maximum length for given charset, + // while litDesc must reflect the real literal length to prevent buffer overrun. + + constant->dsqlDesc = constant->litDesc; + USHORT adjust = 0; if (constant->litDesc.dsc_dtype == dtype_varying) @@ -8068,8 +8073,6 @@ ValueExprNode* LiteralNode::dsqlPass(DsqlCompilerScratch* dsqlScratch) else if (constant->litDesc.dsc_dtype == dtype_cstring) adjust = 1; - constant->litDesc.dsc_length -= adjust; - CharSet* charSet = INTL_charset_lookup(tdbb, INTL_GET_CHARSET(&constant->litDesc)); if (!charSet->wellFormed(dsqlStr->getString().length(), constant->litDesc.dsc_address, NULL)) @@ -8091,11 +8094,9 @@ ValueExprNode* LiteralNode::dsqlPass(DsqlCompilerScratch* dsqlScratch) METD_get_charset_name(dsqlScratch->getTransaction(), constant->litDesc.getCharSet()).toQuotedString()); } else - constant->litDesc.dsc_length = charLength * charSet->maxBytesPerChar(); + constant->dsqlDesc.dsc_length = charLength * charSet->maxBytesPerChar() + adjust; } - constant->litDesc.dsc_length += adjust; - return constant; }