diff --git a/mysql-test/r/loaddata.result b/mysql-test/r/loaddata.result index 98e221b0dea..3a23d9de6b3 100644 --- a/mysql-test/r/loaddata.result +++ b/mysql-test/r/loaddata.result @@ -261,6 +261,82 @@ SELECT * FROM t1; c1 c2 c3 c4 10 1970-02-01 01:02:03 1.1e-100 1.1e+100 DROP TABLE t1; + +# -- +# -- Bug#35469: server crash with LOAD DATA INFILE to a VIEW. +# -- + +DROP TABLE IF EXISTS t1; +DROP VIEW IF EXISTS v1; +DROP VIEW IF EXISTS v2; +DROP VIEW IF EXISTS v3; + +CREATE TABLE t1(c1 INT, c2 VARCHAR(255)); + +CREATE VIEW v1 AS SELECT * FROM t1; +CREATE VIEW v2 AS SELECT 1 + 2 AS c0, c1, c2 FROM t1; +CREATE VIEW v3 AS SELECT 1 AS d1, 2 AS d2; + +LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v1 +FIELDS ESCAPED BY '\\' + TERMINATED BY ',' + ENCLOSED BY '"' + LINES TERMINATED BY '\n' (c1, c2); + +SELECT * FROM t1; +c1 c2 +1 "string1" +2 "string2" +3 "string3" + +SELECT * FROM v1; +c1 c2 +1 "string1" +2 "string2" +3 "string3" + +DELETE FROM t1; + +LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v2 +FIELDS ESCAPED BY '\\' + TERMINATED BY ',' + ENCLOSED BY '"' + LINES TERMINATED BY '\n' (c1, c2); + +SELECT * FROM t1; +c1 c2 +1 "string1" +2 "string2" +3 "string3" + +SELECT * FROM v2; +c0 c1 c2 +3 1 "string1" +3 2 "string2" +3 3 "string3" + +DELETE FROM t1; + +LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v2 +FIELDS ESCAPED BY '\\' + TERMINATED BY ',' + ENCLOSED BY '"' + LINES TERMINATED BY '\n' (c0, c2); +ERROR HY000: Invalid column reference (v2.c0) in LOAD DATA + +LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v3 +FIELDS ESCAPED BY '\\' + TERMINATED BY ',' + ENCLOSED BY '"' + LINES TERMINATED BY '\n' (d1, d2); +ERROR HY000: The target table v3 of the LOAD is not updatable + +DROP TABLE t1; +DROP VIEW v1; +DROP VIEW v2; +DROP VIEW v3; + +# -- End of Bug#35469. CREATE TABLE t1 (a int); INSERT INTO t1 VALUES (1); SET NAMES latin1; diff --git a/mysql-test/std_data/bug35469.dat b/mysql-test/std_data/bug35469.dat new file mode 100644 index 00000000000..afcd9e9cc95 --- /dev/null +++ b/mysql-test/std_data/bug35469.dat @@ -0,0 +1,3 @@ +"1", "string1" +"2", "string2" +"3", "string3" diff --git a/mysql-test/t/loaddata.test b/mysql-test/t/loaddata.test index 5433d787c14..affb6c3bac7 100644 --- a/mysql-test/t/loaddata.test +++ b/mysql-test/t/loaddata.test @@ -240,6 +240,88 @@ SELECT * FROM t1; remove_file $MYSQLTEST_VARDIR/tmp/t1; DROP TABLE t1; +########################################################################### + +--echo +--echo # -- +--echo # -- Bug#35469: server crash with LOAD DATA INFILE to a VIEW. +--echo # -- + +--echo +--disable_warnings +DROP TABLE IF EXISTS t1; +DROP VIEW IF EXISTS v1; +DROP VIEW IF EXISTS v2; +DROP VIEW IF EXISTS v3; +--enable_warnings + +--echo +CREATE TABLE t1(c1 INT, c2 VARCHAR(255)); + +--echo +CREATE VIEW v1 AS SELECT * FROM t1; +CREATE VIEW v2 AS SELECT 1 + 2 AS c0, c1, c2 FROM t1; +CREATE VIEW v3 AS SELECT 1 AS d1, 2 AS d2; + +--echo +LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v1 + FIELDS ESCAPED BY '\\' + TERMINATED BY ',' + ENCLOSED BY '"' + LINES TERMINATED BY '\n' (c1, c2); + +--echo +SELECT * FROM t1; + +--echo +SELECT * FROM v1; + +--echo +DELETE FROM t1; + +--echo +LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v2 + FIELDS ESCAPED BY '\\' + TERMINATED BY ',' + ENCLOSED BY '"' + LINES TERMINATED BY '\n' (c1, c2); + +--echo +SELECT * FROM t1; + +--echo +SELECT * FROM v2; + +--echo +DELETE FROM t1; + +--echo +--error ER_LOAD_DATA_INVALID_COLUMN +LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v2 + FIELDS ESCAPED BY '\\' + TERMINATED BY ',' + ENCLOSED BY '"' + LINES TERMINATED BY '\n' (c0, c2); + +--echo +--error ER_NON_UPDATABLE_TABLE +LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v3 + FIELDS ESCAPED BY '\\' + TERMINATED BY ',' + ENCLOSED BY '"' + LINES TERMINATED BY '\n' (d1, d2); + +--echo +DROP TABLE t1; +DROP VIEW v1; +DROP VIEW v2; +DROP VIEW v3; + +--echo +--echo # -- End of Bug#35469. + +########################################################################### + # End of 5.0 tests diff --git a/sql/share/errmsg.txt b/sql/share/errmsg.txt index 7990baa6bb7..71d024d818a 100644 --- a/sql/share/errmsg.txt +++ b/sql/share/errmsg.txt @@ -6120,3 +6120,6 @@ ER_NO_FORMAT_DESCRIPTION_EVENT_BEFORE_BINLOG_STATEMENT eng "The BINLOG statement of type `%s` was not preceded by a format description BINLOG statement." ER_SLAVE_CORRUPT_EVENT eng "Corrupted replication event was detected" + +ER_LOAD_DATA_INVALID_COLUMN + eng "Invalid column reference (%-.64s) in LOAD DATA" diff --git a/sql/sql_load.cc b/sql/sql_load.cc index a96d6f23a22..255d8e5813d 100644 --- a/sql/sql_load.cc +++ b/sql/sql_load.cc @@ -237,9 +237,11 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list, while ((item= it++)) { - if (item->type() == Item::FIELD_ITEM) + Item *real_item= item->real_item(); + + if (real_item->type() == Item::FIELD_ITEM) { - Field *field= ((Item_field*)item)->field; + Field *field= ((Item_field*)real_item)->field; if (field->flags & BLOB_FLAG) { use_blobs= 1; @@ -248,7 +250,7 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list, else tot_length+= field->field_length; } - else + else if (item->type() == Item::STRING_ITEM) use_vars= 1; } if (use_blobs && !ex->line_term->length() && !field_term->length()) @@ -706,6 +708,7 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list, { uint length; uchar *pos; + Item *real_item; if (read_info.read_field()) break; @@ -717,14 +720,17 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list, pos=read_info.row_start; length=(uint) (read_info.row_end-pos); + real_item= item->real_item(); + if (!read_info.enclosed && (enclosed_length && length == 4 && !memcmp(pos, STRING_WITH_LEN("NULL"))) || (length == 1 && read_info.found_null)) { - if (item->type() == Item::FIELD_ITEM) + + if (real_item->type() == Item::FIELD_ITEM) { - Field *field= ((Item_field *)item)->field; + Field *field= ((Item_field *)real_item)->field; if (field->reset()) { my_error(ER_WARN_NULL_TO_NOTNULL, MYF(0), field->field_name, @@ -741,25 +747,39 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list, ER_WARN_NULL_TO_NOTNULL, 1); } } - else + else if (item->type() == Item::STRING_ITEM) + { ((Item_user_var_as_out_param *)item)->set_null_value( read_info.read_charset); + } + else + { + my_error(ER_LOAD_DATA_INVALID_COLUMN, MYF(0), item->full_name()); + DBUG_RETURN(1); + } + continue; } - if (item->type() == Item::FIELD_ITEM) + if (real_item->type() == Item::FIELD_ITEM) { - - Field *field= ((Item_field *)item)->field; + Field *field= ((Item_field *)real_item)->field; field->set_notnull(); read_info.row_end[0]=0; // Safe to change end marker if (field == table->next_number_field) table->auto_increment_field_not_null= TRUE; field->store((char*) pos, length, read_info.read_charset); } - else + else if (item->type() == Item::STRING_ITEM) + { ((Item_user_var_as_out_param *)item)->set_value((char*) pos, length, - read_info.read_charset); + read_info.read_charset); + } + else + { + my_error(ER_LOAD_DATA_INVALID_COLUMN, MYF(0), item->full_name()); + DBUG_RETURN(1); + } } if (read_info.error) break; @@ -775,9 +795,10 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list, break; for (; item ; item= it++) { - if (item->type() == Item::FIELD_ITEM) + Item *real_item= item->real_item(); + if (real_item->type() == Item::FIELD_ITEM) { - Field *field= ((Item_field *)item)->field; + Field *field= ((Item_field *)real_item)->field; if (field->reset()) { my_error(ER_WARN_NULL_TO_NOTNULL, MYF(0),field->field_name, @@ -797,9 +818,16 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list, ER_WARN_TOO_FEW_RECORDS, ER(ER_WARN_TOO_FEW_RECORDS), thd->row_count); } - else + else if (item->type() == Item::STRING_ITEM) + { ((Item_user_var_as_out_param *)item)->set_null_value( read_info.read_charset); + } + else + { + my_error(ER_LOAD_DATA_INVALID_COLUMN, MYF(0), item->full_name()); + DBUG_RETURN(1); + } } }