Since the MYSQL_FIELD member named length describes the width of a column as
the "display length" (
http://dev.mysql.com/doc/refman/5.0/en/c-api-datatypes.html ), it includes
formatting information--such as the display width for numeric types.  As
documented at http://dev.mysql.com/doc/refman/5.0/en/numeric-types.html , "The
display width does not constrain the range of values that can be stored in the
column, nor the number of digits that are displayed for values having a width
exceeding that specified for the column. For example, a column specified as
SMALLINT(3) has the usual SMALLINT range of -32768 to 32767, and values outside
the range allowed by three characters are displayed using more than three
characters." Therefore, when using length to allocate buffers in
QMYSQLResultPrivate::bindInValues(), the buffer may be too small to hold
values.

The db_length, on the other hand describes the width of the column as
represented in the database.  Therefore, the attached patch changes
QMYSQLResultPrivate::bindInValues() to use db_length when allocating buffers
for non-BLOB fields.


--


Index: qt-x11-opensource-src-4.5.3/src/sql/drivers/mysql/qsql_mysql.cpp
===================================================================
--- qt-x11-opensource-src-4.5.3.orig/src/sql/drivers/mysql/qsql_mysql.cpp	2009-11-12 21:59:14.000000000 -0500
+++ qt-x11-opensource-src-4.5.3/src/sql/drivers/mysql/qsql_mysql.cpp	2009-11-12 23:12:23.000000000 -0500
@@ -365,12 +365,12 @@
             fieldInfo->type = MYSQL_TYPE_STRING;
         }
         bind = &inBinds[i];
-        field = new char[fieldInfo->length + 1];
-        memset(field, 0, fieldInfo->length + 1);
+        field = new char[fieldInfo->db_length + 1];
+        memset(field, 0, fieldInfo->db_length + 1);
 
         bind->buffer_type = fieldInfo->type;
         bind->buffer = field;
-        bind->buffer_length = f.bufLength = fieldInfo->length + 1;
+        bind->buffer_length = f.bufLength = fieldInfo->db_length + 1;
         bind->is_null = &f.nullIndicator;
         bind->length = &f.bufLength;
         f.outField=field;