MDEV-38210: Unary negation of LONGTEXT, wrong result under GROUP BY#5194
MDEV-38210: Unary negation of LONGTEXT, wrong result under GROUP BY#5194DaveGosselin-MariaDB wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Code Review
This pull request addresses MDEV-38210 by fixing an integer overflow issue in Item_func_neg::fix_length_and_dec_double where negating a cast binary value (like LONGTEXT or LONGBLOB) could result in a zero-width output. The fix clamps the argument width before adding the sign character. The review feedback identifies a potential underflow risk in the clamping logic if mlen is 0, and suggests a safer ternary operator implementation to prevent this.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
d73c01f to
c307d91
Compare
Unary negation of a LONGTEXT or LONGBLOB value returned the wrong result under GROUP BY. The length of the result was set to the argument length plus one for the sign, but for these two types the argument length is already the largest value the length field can hold, so adding one wrapped it back to zero. A zero length result loses its value when it is stored in the temporary table that GROUP BY builds, so the query returned an empty value instead of the expected number. The argument length is now limited before the sign character is added, so it can no longer wrap to zero.
c307d91 to
c1adb91
Compare
Unary negation of a LONGTEXT or LONGBLOB value returned the wrong result under GROUP BY. The length of the result was set to the argument length plus one for the sign, but for these two types the argument length is already the largest value the length field can hold, so adding one wrapped it back to zero. A zero length result loses its value when it is stored in the temporary table that GROUP BY builds, so the query returned an empty value instead of the expected number. The argument length is now limited before the sign character is added, so it can no longer wrap to zero.