From ebdd52838299fbb036b8399b53dd347400644a8d Mon Sep 17 00:00:00 2001
From: unknown <karen.langford@oracle.com>
Date: Tue, 22 Jun 2010 19:21:25 +0200
Subject: [PATCH 01/14] Set version number for mysql-5.1.46sp1 release

---
 configure.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.in b/configure.in
index 904c54abb5f..9098ed1f3cb 100644
--- a/configure.in
+++ b/configure.in
@@ -12,7 +12,7 @@ dnl
 dnl When changing the major version number please also check the switch
 dnl statement in mysqlbinlog::check_master_version().  You may also need
 dnl to update version.c in ndb.
-AC_INIT([MySQL Server], [5.1.46], [], [mysql])
+AC_INIT([MySQL Server], [5.1.46sp1], [], [mysql])
 
 AC_CONFIG_SRCDIR([sql/mysqld.cc])
 AC_CANONICAL_SYSTEM

From eea50ea20dcdae7fe8c3bb182d030cdb79e8c1e0 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:42:14 +0200
Subject: [PATCH 02/14] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3362
> revision-id: davi.arnaut@sun.com-20100401131522-895y8uzvv8ag44gs
> parent: ramil@mysql.com-20100429045409-r7r5lcyiruis15v7
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: 50755-5.1
> timestamp: Thu 2010-04-01 10:15:22 -0300
> message:
>   Bug#50755: Crash if stored routine def contains version comments
>
>   The problem was that a syntactically invalid trigger could cause
>   the server to crash when trying to list triggers. The crash would
>   happen due to a mishap in the backup/restore procedure that should
>   protect parser items which are not associated with the trigger. The
>   backup/restore is used to isolate the parse tree (and context) of
>   a statement from the load (and parsing) of a trigger. In this case,
>   a error during the parsing of a trigger could cause the improper
>   backup/restore sequence.
>
>   The solution is to properly restore the original statement context
>   before the parser is exited due to syntax errors in the trigger body.
---
 mysql-test/r/trigger.result | 23 +++++++++++++++++++++++
 mysql-test/t/trigger.test   | 31 +++++++++++++++++++++++++++++++
 sql/sp_head.cc              | 36 ++++++++++++++----------------------
 sql/sp_head.h               |  4 ----
 sql/sql_lex.cc              |  1 +
 5 files changed, 69 insertions(+), 26 deletions(-)

diff --git a/mysql-test/r/trigger.result b/mysql-test/r/trigger.result
index 3446babbb52..e3c0b0e1dd9 100644
--- a/mysql-test/r/trigger.result
+++ b/mysql-test/r/trigger.result
@@ -2128,4 +2128,27 @@ Warning	1048	Column 'id' cannot be null
 Warning	1048	Column 'id' cannot be null
 DROP TRIGGER t1_bu;
 DROP TABLE t1,t2;
+#
+# Bug#50755: Crash if stored routine def contains version comments
+#
+DROP DATABASE IF EXISTS db1;
+DROP TRIGGER IF EXISTS trg1;
+DROP TABLE IF EXISTS t1, t2;
+CREATE DATABASE db1;
+USE db1;
+CREATE TABLE t1 (b INT);
+CREATE TABLE t2 (a INT);
+CREATE TRIGGER trg1 BEFORE INSERT ON t2 FOR EACH ROW INSERT/*!INTO*/t1 VALUES (1);
+# Used to crash
+SHOW TRIGGERS IN db1;
+Trigger	Event	Table	Statement	Timing	Created	sql_mode	Definer	character_set_client	collation_connection	Database Collation
+Warnings:
+Warning	1064	You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'VALUES (1)' at line 1
+INSERT INTO t2 VALUES (1);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'VALUES (1)' at line 1
+SELECT * FROM t1;
+b
+# Work around Bug#45235
+DROP DATABASE db1;
+USE test;
 End of 5.1 tests.
diff --git a/mysql-test/t/trigger.test b/mysql-test/t/trigger.test
index 368271f1fb2..bcbca4d2139 100644
--- a/mysql-test/t/trigger.test
+++ b/mysql-test/t/trigger.test
@@ -2439,4 +2439,35 @@ UPDATE t1 SET id=NULL;
 DROP TRIGGER t1_bu;
 DROP TABLE t1,t2;
 
+--echo #
+--echo # Bug#50755: Crash if stored routine def contains version comments
+--echo #
+
+--disable_warnings
+DROP DATABASE IF EXISTS db1;
+DROP TRIGGER IF EXISTS trg1;
+DROP TABLE IF EXISTS t1, t2;
+--enable_warnings
+
+CREATE DATABASE db1;
+USE db1;
+
+CREATE TABLE t1 (b INT);
+CREATE TABLE t2 (a INT);
+
+CREATE TRIGGER trg1 BEFORE INSERT ON t2 FOR EACH ROW INSERT/*!INTO*/t1 VALUES (1);
+--echo # Used to crash
+SHOW TRIGGERS IN db1;
+--error ER_PARSE_ERROR
+INSERT INTO t2 VALUES (1);
+SELECT * FROM t1;
+
+--echo # Work around Bug#45235
+let $MYSQLD_DATADIR = `select @@datadir`;
+--remove_file $MYSQLD_DATADIR/db1/t2.TRG
+--remove_file $MYSQLD_DATADIR/db1/trg1.TRN
+
+DROP DATABASE db1;
+USE test;
+
 --echo End of 5.1 tests.
diff --git a/sql/sp_head.cc b/sql/sp_head.cc
index 11d5e5f830b..cadda38053c 100644
--- a/sql/sp_head.cc
+++ b/sql/sp_head.cc
@@ -745,21 +745,12 @@ sp_head::create(THD *thd)
 
 sp_head::~sp_head()
 {
-  DBUG_ENTER("sp_head::~sp_head");
-  destroy();
-  delete m_next_cached_sp;
-  if (m_thd)
-    restore_thd_mem_root(m_thd);
-  DBUG_VOID_RETURN;
-}
-
-void
-sp_head::destroy()
-{
-  sp_instr *i;
   LEX *lex;
-  DBUG_ENTER("sp_head::destroy");
-  DBUG_PRINT("info", ("name: %s", m_name.str));
+  sp_instr *i;
+  DBUG_ENTER("sp_head::~sp_head");
+
+  /* sp_head::restore_thd_mem_root() must already have been called. */
+  DBUG_ASSERT(m_thd == NULL);
 
   for (uint ip = 0 ; (i = get_instr(ip)) ; ip++)
     delete i;
@@ -770,21 +761,22 @@ sp_head::destroy()
   /*
     If we have non-empty LEX stack then we just came out of parser with
     error. Now we should delete all auxilary LEXes and restore original
-    THD::lex (In this case sp_head::restore_thd_mem_root() was not called
-    too, so m_thd points to the current thread context).
-    It is safe to not update LEX::ptr because further query string parsing
-    and execution will be stopped anyway.
+    THD::lex. It is safe to not update LEX::ptr because further query
+    string parsing and execution will be stopped anyway.
   */
-  DBUG_ASSERT(m_lex.is_empty() || m_thd);
   while ((lex= (LEX *)m_lex.pop()))
   {
-    lex_end(m_thd->lex);
-    delete m_thd->lex;
-    m_thd->lex= lex;
+    THD *thd= lex->thd;
+    lex_end(thd->lex);
+    delete thd->lex;
+    thd->lex= lex;
   }
 
   hash_free(&m_sptabs);
   hash_free(&m_sroutines);
+
+  delete m_next_cached_sp;
+
   DBUG_VOID_RETURN;
 }
 
diff --git a/sql/sp_head.h b/sql/sp_head.h
index 00c96d44f70..d422adc8927 100644
--- a/sql/sp_head.h
+++ b/sql/sp_head.h
@@ -289,10 +289,6 @@ public:
 
   virtual ~sp_head();
 
-  /// Free memory
-  void
-  destroy();
-
   bool
   execute_trigger(THD *thd,
                   const LEX_STRING *db_name,
diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 5097ca2ad5b..a3776f59241 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -2106,6 +2106,7 @@ void st_lex::cleanup_lex_after_parse_error(THD *thd)
   */
   if (thd->lex->sphead)
   {
+    thd->lex->sphead->restore_thd_mem_root(thd);
     delete thd->lex->sphead;
     thd->lex->sphead= NULL;
   }

From d2c104fd129c648b6b89d612d9144b4594525732 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:50:47 +0200
Subject: [PATCH 03/14] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.50
> revision-id: marko.makela@oracle.com-20100421185359-8qaxoa2yyrpzwdd7
> parent: marko.makela@oracle.com-20100421102723-0i80uezbyu0ekj5d
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Wed 2010-04-21 21:53:59 +0300
> message:
>   btr_page_split_and_insert(): Avoid an infinite loop. (Bug #52964)
>
>   btr_page_tuple_smaller(): New function, refactored from
>   btr_page_split_and_insert().
>
>   btr_page_get_split_rec(): Renamed from btr_page_get_sure_split_rec().
>   Note that a NULL return may mean that the tuple is to be inserted into
>   either the lower or upper page, to be determined by btr_page_tuple_smaller().
>
>   btr_page_split_and_insert(): When btr_page_get_split_rec() returns NULL,
>   invoke btr_page_tuple_smaller() to determine which half-page the tuple
>   belongs to.
>
>   Reviewed by Sunny Bains
---
 storage/innodb_plugin/btr/btr0btr.c | 91 +++++++++++++++++++----------
 1 file changed, 59 insertions(+), 32 deletions(-)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index fa4fc05d96b..cd8f42b3818 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -1451,11 +1451,11 @@ Calculates a split record such that the tuple will certainly fit on
 its half-page when the split is performed. We assume in this function
 only that the cursor page has at least one user record.
 @return split record, or NULL if tuple will be the first record on
-upper half-page */
+the lower or upper half-page (determined by btr_page_tuple_smaller()) */
 static
 rec_t*
-btr_page_get_sure_split_rec(
-/*========================*/
+btr_page_get_split_rec(
+/*===================*/
 	btr_cur_t*	cursor,	/*!< in: cursor at which insert should be made */
 	const dtuple_t*	tuple,	/*!< in: tuple to insert */
 	ulint		n_ext)	/*!< in: number of externally stored columns */
@@ -1831,6 +1831,37 @@ btr_attach_half_pages(
 	btr_page_set_next(upper_page, upper_page_zip, next_page_no, mtr);
 }
 
+/*************************************************************//**
+Determine if a tuple is smaller than any record on the page.
+@return TRUE if smaller */
+static
+ibool
+btr_page_tuple_smaller(
+/*===================*/
+	btr_cur_t*	cursor,	/*!< in: b-tree cursor */
+	const dtuple_t*	tuple,	/*!< in: tuple to consider */
+	ulint*		offsets,/*!< in/out: temporary storage */
+	ulint		n_uniq,	/*!< in: number of unique fields
+				in the index page records */
+	mem_heap_t**	heap)	/*!< in/out: heap for offsets */
+{
+	buf_block_t*	block;
+	const rec_t*	first_rec;
+	page_cur_t	pcur;
+
+	/* Read the first user record in the page. */
+	block = btr_cur_get_block(cursor);
+	page_cur_set_before_first(block, &pcur);
+	page_cur_move_to_next(&pcur);
+	first_rec = page_cur_get_rec(&pcur);
+
+	offsets = rec_get_offsets(
+		first_rec, cursor->index, offsets,
+		n_uniq, heap);
+
+	return(cmp_dtuple_rec(tuple, first_rec, offsets) < 0);
+}
+
 /*************************************************************//**
 Splits an index page to halves and inserts the tuple. It is assumed
 that mtr holds an x-latch to the index tree. NOTE: the tree x-latch is
@@ -1905,49 +1936,45 @@ func_start:
 	if (n_iterations > 0) {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
-		split_rec = btr_page_get_sure_split_rec(cursor, tuple, n_ext);
+		split_rec = btr_page_get_split_rec(cursor, tuple, n_ext);
 
+		if (UNIV_UNLIKELY(split_rec == NULL)) {
+			insert_left = btr_page_tuple_smaller(
+				cursor, tuple, offsets, n_uniq, &heap);
+		}
 	} else if (btr_page_get_split_rec_to_right(cursor, &split_rec)) {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
+		insert_left = FALSE;
 
 	} else if (btr_page_get_split_rec_to_left(cursor, &split_rec)) {
 		direction = FSP_DOWN;
 		hint_page_no = page_no - 1;
+		ut_ad(split_rec);
 	} else {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
 
-		if (page_get_n_recs(page) == 1) {
-			page_cur_t	pcur;
+		/* If there is only one record in the index page, we
+		can't split the node in the middle by default. We need
+		to determine whether the new record will be inserted
+		to the left or right. */
 
-			/* There is only one record in the index page
-			therefore we can't split the node in the middle
-			by default. We need to determine whether the
-			new record will be inserted to the left or right. */
-
-			/* Read the first (and only) record in the page. */
-			page_cur_set_before_first(block, &pcur);
-			page_cur_move_to_next(&pcur);
-			first_rec = page_cur_get_rec(&pcur);
-
-			offsets = rec_get_offsets(
-				first_rec, cursor->index, offsets,
-				n_uniq, &heap);
-
-			/* If the new record is less than the existing record
-			the split in the middle will copy the existing
-			record to the new node. */
-			if (cmp_dtuple_rec(tuple, first_rec, offsets) < 0) {
-				split_rec = page_get_middle_rec(page);
-			} else {
-				split_rec = NULL;
-			}
-		} else {
+		if (page_get_n_recs(page) > 1) {
 			split_rec = page_get_middle_rec(page);
+		} else if (btr_page_tuple_smaller(cursor, tuple,
+						  offsets, n_uniq, &heap)) {
+			split_rec = page_rec_get_next(
+				page_get_infimum_rec(page));
+		} else {
+			split_rec = NULL;
+			insert_left = FALSE;
 		}
 	}
 
+	/* At this point, insert_left is initialized if split_rec == NULL
+	and may be uninitialized otherwise. */
+
 	/* 2. Allocate a new page to the index */
 	new_block = btr_page_alloc(cursor->index, hint_page_no, direction,
 				   btr_page_get_level(page, mtr), mtr);
@@ -1974,11 +2001,11 @@ func_start:
 			avoid further splits by inserting the record
 			to an empty page. */
 			split_rec = NULL;
-			goto insert_right;
+			goto insert_empty;
 		}
 	} else {
-insert_right:
-		insert_left = FALSE;
+insert_empty:
+		ut_ad(!split_rec);
 		buf = mem_alloc(rec_get_converted_size(cursor->index,
 						       tuple, n_ext));
 

From 65379cccc84bb5324413dfd6d3fd09b496612361 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:52:43 +0200
Subject: [PATCH 04/14] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.74
> revision-id: marko.makela@oracle.com-20100504093128-44v6glupe1dsh0ug
> parent: marko.makela@oracle.com-20100503122859-k73bl51re93o0mt4
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Tue 2010-05-04 12:31:28 +0300
> message:
>   btr_page_split_and_insert(): Correct the fix of Bug #52964.
>   When split_rec==NULL, choose the correct node pointer key (first_rec).
---
 storage/innodb_plugin/btr/btr0btr.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index cd8f42b3818..1d6b4f5a0e6 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -2003,9 +2003,13 @@ func_start:
 			split_rec = NULL;
 			goto insert_empty;
 		}
+	} else if (UNIV_UNLIKELY(insert_left)) {
+		first_rec = page_rec_get_next(page_get_infimum_rec(page));
+		move_limit = page_rec_get_next(btr_cur_get_rec(cursor));
 	} else {
 insert_empty:
 		ut_ad(!split_rec);
+		ut_ad(!insert_left);
 		buf = mem_alloc(rec_get_converted_size(cursor->index,
 						       tuple, n_ext));
 
@@ -2029,7 +2033,11 @@ insert_empty:
 			&& btr_page_insert_fits(cursor, split_rec,
 						offsets, tuple, n_ext, heap);
 	} else {
-		mem_free(buf);
+		if (!insert_left) {
+			mem_free(buf);
+			buf = NULL;
+		}
+
 		insert_will_fit = !new_page_zip
 			&& btr_page_insert_fits(cursor, NULL,
 						NULL, tuple, n_ext, heap);

From 1cab479221f6d9fbe0fc44414b5b6a9bc7c9f009 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:54:41 +0200
Subject: [PATCH 05/14] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.47.1
> revision-id: marko.makela@oracle.com-20100511104500-c6kzd0bg5s42p8e9
> parent: vasil.dimov@oracle.com-20100510132852-cz457uqvj8iiy9mm
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: mysql-5.1-innodb2
> timestamp: Tue 2010-05-11 13:45:00 +0300
> message:
>   Remove a stray expression. Spotted by Sunny Bains.
---
 storage/innodb_plugin/page/page0zip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/storage/innodb_plugin/page/page0zip.c b/storage/innodb_plugin/page/page0zip.c
index aa5e39ff04a..a64a41ea518 100644
--- a/storage/innodb_plugin/page/page0zip.c
+++ b/storage/innodb_plugin/page/page0zip.c
@@ -571,7 +571,7 @@ page_zip_dir_encode(
 	/* Traverse the list of stored records in the collation order,
 	starting from the first user record. */
 
-	rec = page + PAGE_NEW_INFIMUM, TRUE;
+	rec = page + PAGE_NEW_INFIMUM;
 
 	i = 0;
 

From e87a2d917b39043ce7124aae8788e8247e611211 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:56:18 +0200
Subject: [PATCH 06/14] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.47.2
> revision-id: marko.makela@oracle.com-20100511104910-nim8kgguawpis7zo
> parent: marko.makela@oracle.com-20100511104500-c6kzd0bg5s42p8e9
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: mysql-5.1-innodb2
> timestamp: Tue 2010-05-11 13:49:10 +0300
> message:
>   btr_page_split_and_insert(): Add an assertion
>   suggested by Sunny Bains when reviewing Bug #52964.
---
 storage/innodb_plugin/btr/btr0btr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index 1d6b4f5a0e6..0fd209e0216 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -2004,6 +2004,7 @@ func_start:
 			goto insert_empty;
 		}
 	} else if (UNIV_UNLIKELY(insert_left)) {
+		ut_a(n_iterations > 0);
 		first_rec = page_rec_get_next(page_get_infimum_rec(page));
 		move_limit = page_rec_get_next(btr_cur_get_rec(cursor));
 	} else {

From f5a0316a3962ce34f3586574be5598d2bacd5ccb Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:59:35 +0200
Subject: [PATCH 07/14] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.47
> revision-id: marko.makela@oracle.com-20100421095033-0acvzxb8um8cms0a
> parent: marko.makela@oracle.com-20100421094032-ir4glqk46qvg2ywn
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Wed 2010-04-21 12:50:33 +0300
> message:
>   dtuple_convert_big_rec(): Store locally any fields whose maximum length
>   is less than 256 bytes. (Bug #52745)
>   Add related comments and debug assertions to the "offsets"
>   functions in rem0rec.c.
>   Approved by Sunny Bains
---
 storage/innodb_plugin/data/data0data.c | 15 +++++++
 storage/innodb_plugin/rem/rem0rec.c    | 59 +++++++++++++++++++++++++-
 2 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/storage/innodb_plugin/data/data0data.c b/storage/innodb_plugin/data/data0data.c
index e3c1f1b4f23..0715b49bf9c 100644
--- a/storage/innodb_plugin/data/data0data.c
+++ b/storage/innodb_plugin/data/data0data.c
@@ -666,6 +666,21 @@ dtuple_convert_big_rec(
 				goto skip_field;
 			}
 
+			/* In DYNAMIC and COMPRESSED format, store
+			locally any non-BLOB columns whose maximum
+			length does not exceed 256 bytes.  This is
+			because there is no room for the "external
+			storage" flag when the maximum length is 255
+			bytes or less. This restriction trivially
+			holds in REDUNDANT and COMPACT format, because
+			there we always store locally columns whose
+			length is up to local_len == 788 bytes.
+			@see rec_init_offsets_comp_ordinary */
+			if (ifield->col->mtype != DATA_BLOB
+			    && ifield->col->len < 256) {
+				goto skip_field;
+			}
+
 			longest_i = i;
 			longest = savings;
 
diff --git a/storage/innodb_plugin/rem/rem0rec.c b/storage/innodb_plugin/rem/rem0rec.c
index 27c11dacc8c..59cf6e887d1 100644
--- a/storage/innodb_plugin/rem/rem0rec.c
+++ b/storage/innodb_plugin/rem/rem0rec.c
@@ -212,6 +212,13 @@ rec_get_n_extern_new(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens--;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype == DATA_BLOB)) {
 				if (len & 0x80) {
@@ -294,6 +301,13 @@ rec_init_offsets_comp_ordinary(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens--;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype
 					     == DATA_BLOB)) {
@@ -425,6 +439,15 @@ rec_init_offsets(
 				const dict_col_t*	col
 					= dict_field_get_col(field);
 				len = *lens--;
+				/* If the maximum length of the field
+				is up to 255 bytes, the actual length
+				is always stored in one byte. If the
+				maximum length is more than 255 bytes,
+				the actual length is stored in one
+				byte for 0..127.  The length will be
+				encoded in two bytes when it is 128 or
+				more, or when the field is stored
+				externally. */
 				if (UNIV_UNLIKELY(col->len > 255)
 				    || UNIV_UNLIKELY(col->mtype
 						     == DATA_BLOB)) {
@@ -647,6 +670,13 @@ rec_get_offsets_reverse(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens++;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype == DATA_BLOB)) {
 				if (len & 0x80) {
@@ -781,12 +811,20 @@ rec_get_converted_size_comp_prefix(
 
 		ut_ad(len <= col->len || col->mtype == DATA_BLOB);
 
+		/* If the maximum length of a variable-length field
+		is up to 255 bytes, the actual length is always stored
+		in one byte. If the maximum length is more than 255
+		bytes, the actual length is stored in one byte for
+		0..127.  The length will be encoded in two bytes when
+		it is 128 or more, or when the field is stored externally. */
+
 		if (field->fixed_len) {
 			ut_ad(len == field->fixed_len);
 			/* dict_index_add_col() should guarantee this */
 			ut_ad(!field->prefix_len
 			      || field->fixed_len == field->prefix_len);
 		} else if (dfield_is_ext(&fields[i])) {
+			ut_ad(col->len >= 256 || col->mtype == DATA_BLOB);
 			extra_size += 2;
 		} else if (len < 128
 			   || (col->len < 256 && col->mtype != DATA_BLOB)) {
@@ -1086,6 +1124,8 @@ rec_convert_dtuple_to_rec_comp(
 	/* Store the data and the offsets */
 
 	for (i = 0, field = fields; i < n_fields; i++, field++) {
+		const dict_field_t*	ifield;
+
 		type = dfield_get_type(field);
 		len = dfield_get_len(field);
 
@@ -1120,12 +1160,20 @@ rec_convert_dtuple_to_rec_comp(
 		/* only nullable fields can be null */
 		ut_ad(!dfield_is_null(field));
 
-		fixed_len = dict_index_get_nth_field(index, i)->fixed_len;
-
+		ifield = dict_index_get_nth_field(index, i);
+		fixed_len = ifield->fixed_len;
+		/* If the maximum length of a variable-length field
+		is up to 255 bytes, the actual length is always stored
+		in one byte. If the maximum length is more than 255
+		bytes, the actual length is stored in one byte for
+		0..127.  The length will be encoded in two bytes when
+		it is 128 or more, or when the field is stored externally. */
 		if (fixed_len) {
 			ut_ad(len == fixed_len);
 			ut_ad(!dfield_is_ext(field));
 		} else if (dfield_is_ext(field)) {
+			ut_ad(ifield->col->len >= 256
+			      || ifield->col->mtype == DATA_BLOB);
 			ut_ad(len <= REC_MAX_INDEX_COL_LEN
 			      + BTR_EXTERN_FIELD_REF_SIZE);
 			*lens-- = (byte) (len >> 8) | 0xc0;
@@ -1402,6 +1450,13 @@ rec_copy_prefix_to_buf(
 			prefix_len += field->fixed_len;
 		} else {
 			ulint	len = *lens--;
+			/* If the maximum length of the column is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the column is stored externally. */
 			if (col->len > 255 || col->mtype == DATA_BLOB) {
 				if (len & 0x80) {
 					/* 1exxxxxx */

From 4f066e52694cb41ed950ed0a92d4518de9cd89bf Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:09:31 +0200
Subject: [PATCH 08/14] Backport into 5.1.46sp1:

> revno: 3351.14.56
> committer: Marko Mdkeld <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Mon 2010-04-26 14:08:56 +0300
> message:
>   Add a test case for Bug #52745.
---
 .../innodb_plugin/r/innodb_bug52745.result    | 130 ++++++++++++++++++
 .../innodb_plugin/t/innodb_bug52745.test      | 109 +++++++++++++++
 2 files changed, 239 insertions(+)
 create mode 100644 mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
 create mode 100644 mysql-test/suite/innodb_plugin/t/innodb_bug52745.test

diff --git a/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result b/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
new file mode 100644
index 00000000000..254c6525257
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
@@ -0,0 +1,130 @@
+SET GLOBAL innodb_file_format='Barracuda';
+SET GLOBAL innodb_file_per_table=on;
+CREATE TABLE bug52745 (
+a2 int(10) unsigned DEFAULT NULL,
+col37 time DEFAULT NULL,
+col38 char(229) CHARACTER SET utf8 DEFAULT NULL,
+col39 text,
+col40 timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+col41 int(10) unsigned DEFAULT NULL,
+col42 varchar(248) CHARACTER SET utf8 DEFAULT NULL,
+col43 smallint(5) unsigned zerofill DEFAULT NULL,
+col44 varchar(150) CHARACTER SET utf8 DEFAULT NULL,
+col45 float unsigned zerofill DEFAULT NULL,
+col46 binary(1) DEFAULT NULL,
+col47 tinyint(4) DEFAULT NULL,
+col48 tinyint(1) DEFAULT NULL,
+col49 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col50 binary(1) DEFAULT NULL,
+col51 double unsigned zerofill DEFAULT NULL,
+col52 int(10) unsigned DEFAULT NULL,
+col53 time DEFAULT NULL,
+col54 double unsigned DEFAULT NULL,
+col55 time DEFAULT NULL,
+col56 mediumtext CHARACTER SET latin2,
+col57 blob,
+col58 decimal(52,16) unsigned zerofill NOT NULL DEFAULT '000000000000000000000000000000000000.0000000000000000',
+col59 binary(1) DEFAULT NULL,
+col60 longblob,
+col61 time DEFAULT NULL,
+col62 longtext CHARACTER SET utf8 COLLATE utf8_persian_ci,
+col63 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col64 int(10) unsigned DEFAULT NULL,
+col65 date DEFAULT NULL,
+col66 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col67 binary(1) DEFAULT NULL,
+col68 tinyblob,
+col69 date DEFAULT NULL,
+col70 tinyint(3) unsigned zerofill DEFAULT NULL,
+col71 varchar(44) CHARACTER SET utf8 DEFAULT NULL,
+col72 datetime DEFAULT NULL,
+col73 smallint(5) unsigned zerofill DEFAULT NULL,
+col74 longblob,
+col75 bit(34) DEFAULT NULL,
+col76 float unsigned zerofill DEFAULT NULL,
+col77 year(2) DEFAULT NULL,
+col78 tinyint(3) unsigned DEFAULT NULL,
+col79 set('msfheowh','tbpxbgf','by','wahnrjw','myqfasxz','rsokyumrt') CHARACTER SET latin2 DEFAULT NULL,
+col80 datetime DEFAULT NULL,
+col81 smallint(6) DEFAULT NULL,
+col82 enum('xtaurnqfqz','rifrse','kuzwpbvb','niisabk','zxavro','rbvasv','','uulrfaove','','') DEFAULT NULL,
+col83 bigint(20) unsigned zerofill DEFAULT NULL,
+col84 float unsigned zerofill DEFAULT NULL,
+col85 double DEFAULT NULL,
+col86 enum('ylannv','','vlkhycqc','snke','cxifustp','xiaxaswzp','oxl') CHARACTER SET latin1 COLLATE latin1_german2_ci DEFAULT NULL,
+col87 varbinary(221) DEFAULT NULL,
+col88 double unsigned DEFAULT NULL,
+col89 float unsigned zerofill DEFAULT NULL,
+col90 tinyblob
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 ROW_FORMAT=COMPRESSED KEY_BLOCK_SIZE=1;
+Warnings:
+Note	1291	Column 'col82' has duplicated value '' in ENUM
+Note	1291	Column 'col82' has duplicated value '' in ENUM
+INSERT INTO bug52745 SET
+col40='0000-00-00 00:00:00',
+col51=16547,
+col53='7711484',
+col54=-28604,
+col55='7112612',
+col56='wakefulness\'',
+col57=repeat('absorbefacient\'',106),
+col58=11027,
+col59='AM09gW7',
+col60=repeat('Noelani\'',16),
+col61='2520576',
+col62='substitutiv',
+col63='19950106155112',
+col64=-12038,
+col65='86238806',
+col66='19600719080256',
+col68=repeat('Sagittarius\'',54),
+col69='38943902',
+col70=1232,
+col71='Elora\'',
+col74=repeat('zipp',11),
+col75='0',
+col76=23254,
+col78=13247,
+col79='56219',
+col80='20500609035724',
+col81=11632,
+col82=7,
+col84=-23863,
+col85=6341,
+col87='HZdkf.4 s7t,5Rmq	8so fmr,ruGLUG25TrtI.yQ	2SuHq0ML7rw7.4 b2yf2E5TJxOtBBZImezDnzpj,uPYfznnEUDN1e9aQoO 2DsplB7TFWy	oQJ br  HLF :F,eQ p4i1oWsr lL3PG,hjCz6hYqN h1QTjLCjrv:QCdSzpYBibJAtZCxLOk3l6Blsh.W',
+col88=16894,
+col89=6161,
+col90=repeat('gale',48);
+Warnings:
+Warning	1265	Data truncated for column 'col53' at row 1
+Warning	1264	Out of range value for column 'col54' at row 1
+Warning	1265	Data truncated for column 'col59' at row 1
+Warning	1265	Data truncated for column 'col61' at row 1
+Warning	1264	Out of range value for column 'col64' at row 1
+Warning	1265	Data truncated for column 'col65' at row 1
+Warning	1264	Out of range value for column 'col66' at row 1
+Warning	1265	Data truncated for column 'col68' at row 1
+Warning	1265	Data truncated for column 'col69' at row 1
+Warning	1264	Out of range value for column 'col70' at row 1
+Warning	1264	Out of range value for column 'col78' at row 1
+Warning	1265	Data truncated for column 'col79' at row 1
+Warning	1264	Out of range value for column 'col84' at row 1
+SHOW WARNINGS;
+Level	Code	Message
+Warning	1265	Data truncated for column 'col53' at row 1
+Warning	1264	Out of range value for column 'col54' at row 1
+Warning	1265	Data truncated for column 'col59' at row 1
+Warning	1265	Data truncated for column 'col61' at row 1
+Warning	1264	Out of range value for column 'col64' at row 1
+Warning	1265	Data truncated for column 'col65' at row 1
+Warning	1264	Out of range value for column 'col66' at row 1
+Warning	1265	Data truncated for column 'col68' at row 1
+Warning	1265	Data truncated for column 'col69' at row 1
+Warning	1264	Out of range value for column 'col70' at row 1
+Warning	1264	Out of range value for column 'col78' at row 1
+Warning	1265	Data truncated for column 'col79' at row 1
+Warning	1264	Out of range value for column 'col84' at row 1
+DROP TABLE bug52745;
+SET GLOBAL innodb_file_format=Antelope;
+SET GLOBAL innodb_file_format_check=Antelope;
+SET GLOBAL innodb_file_per_table=0;
diff --git a/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test b/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test
new file mode 100644
index 00000000000..b20a993a2d1
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test
@@ -0,0 +1,109 @@
+-- source include/have_innodb_plugin.inc
+
+let $file_format=`select @@innodb_file_format`;
+let $file_format_check=`select @@innodb_file_format_check`;
+let $file_per_table=`select @@innodb_file_per_table`;
+SET GLOBAL innodb_file_format='Barracuda';
+SET GLOBAL innodb_file_per_table=on;
+
+CREATE TABLE bug52745 (
+  a2 int(10) unsigned DEFAULT NULL,
+  col37 time DEFAULT NULL,
+  col38 char(229) CHARACTER SET utf8 DEFAULT NULL,
+  col39 text,
+  col40 timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  col41 int(10) unsigned DEFAULT NULL,
+  col42 varchar(248) CHARACTER SET utf8 DEFAULT NULL,
+  col43 smallint(5) unsigned zerofill DEFAULT NULL,
+  col44 varchar(150) CHARACTER SET utf8 DEFAULT NULL,
+  col45 float unsigned zerofill DEFAULT NULL,
+  col46 binary(1) DEFAULT NULL,
+  col47 tinyint(4) DEFAULT NULL,
+  col48 tinyint(1) DEFAULT NULL,
+  col49 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col50 binary(1) DEFAULT NULL,
+  col51 double unsigned zerofill DEFAULT NULL,
+  col52 int(10) unsigned DEFAULT NULL,
+  col53 time DEFAULT NULL,
+  col54 double unsigned DEFAULT NULL,
+  col55 time DEFAULT NULL,
+  col56 mediumtext CHARACTER SET latin2,
+  col57 blob,
+  col58 decimal(52,16) unsigned zerofill NOT NULL DEFAULT '000000000000000000000000000000000000.0000000000000000',
+  col59 binary(1) DEFAULT NULL,
+  col60 longblob,
+  col61 time DEFAULT NULL,
+  col62 longtext CHARACTER SET utf8 COLLATE utf8_persian_ci,
+  col63 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col64 int(10) unsigned DEFAULT NULL,
+  col65 date DEFAULT NULL,
+  col66 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col67 binary(1) DEFAULT NULL,
+  col68 tinyblob,
+  col69 date DEFAULT NULL,
+  col70 tinyint(3) unsigned zerofill DEFAULT NULL,
+  col71 varchar(44) CHARACTER SET utf8 DEFAULT NULL,
+  col72 datetime DEFAULT NULL,
+  col73 smallint(5) unsigned zerofill DEFAULT NULL,
+  col74 longblob,
+  col75 bit(34) DEFAULT NULL,
+  col76 float unsigned zerofill DEFAULT NULL,
+  col77 year(2) DEFAULT NULL,
+  col78 tinyint(3) unsigned DEFAULT NULL,
+  col79 set('msfheowh','tbpxbgf','by','wahnrjw','myqfasxz','rsokyumrt') CHARACTER SET latin2 DEFAULT NULL,
+  col80 datetime DEFAULT NULL,
+  col81 smallint(6) DEFAULT NULL,
+  col82 enum('xtaurnqfqz','rifrse','kuzwpbvb','niisabk','zxavro','rbvasv','','uulrfaove','','') DEFAULT NULL,
+  col83 bigint(20) unsigned zerofill DEFAULT NULL,
+  col84 float unsigned zerofill DEFAULT NULL,
+  col85 double DEFAULT NULL,
+  col86 enum('ylannv','','vlkhycqc','snke','cxifustp','xiaxaswzp','oxl') CHARACTER SET latin1 COLLATE latin1_german2_ci DEFAULT NULL,
+  col87 varbinary(221) DEFAULT NULL,
+  col88 double unsigned DEFAULT NULL,
+  col89 float unsigned zerofill DEFAULT NULL,
+  col90 tinyblob
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 ROW_FORMAT=COMPRESSED KEY_BLOCK_SIZE=1;
+
+INSERT INTO bug52745 SET
+col40='0000-00-00 00:00:00',
+col51=16547,
+col53='7711484',
+col54=-28604,
+col55='7112612',
+col56='wakefulness\'',
+col57=repeat('absorbefacient\'',106),
+col58=11027,
+col59='AM09gW7',
+col60=repeat('Noelani\'',16),
+col61='2520576',
+col62='substitutiv',
+col63='19950106155112',
+col64=-12038,
+col65='86238806',
+col66='19600719080256',
+col68=repeat('Sagittarius\'',54),
+col69='38943902',
+col70=1232,
+col71='Elora\'',
+col74=repeat('zipp',11),
+col75='0',
+col76=23254,
+col78=13247,
+col79='56219',
+col80='20500609035724',
+col81=11632,
+col82=7,
+col84=-23863,
+col85=6341,
+col87='HZdkf.4 s7t,5Rmq	8so fmr,ruGLUG25TrtI.yQ	2SuHq0ML7rw7.4 b2yf2E5TJxOtBBZImezDnzpj,uPYfznnEUDN1e9aQoO 2DsplB7TFWy	oQJ br  HLF :F,eQ p4i1oWsr lL3PG,hjCz6hYqN h1QTjLCjrv:QCdSzpYBibJAtZCxLOk3l6Blsh.W',
+col88=16894,
+col89=6161,
+col90=repeat('gale',48);
+
+SHOW WARNINGS;
+
+DROP TABLE bug52745;
+
+EVAL SET GLOBAL innodb_file_format=$file_format;
+EVAL SET GLOBAL innodb_file_format_check=$file_format_check;
+EVAL SET GLOBAL innodb_file_per_table=$file_per_table;

From 01490413d26cd31f319928e30724bd5a28e82e42 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:34:48 +0200
Subject: [PATCH 09/14] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 1810.3987.13
> revision-id: ramil@mysql.com-20100429044232-f0pkyx8fnpszf142
> parent: alexey.kopytov@sun.com-20100426200600-op06qy98llzpzgl1
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: b53237-5.0-bugteam
> timestamp: Thu 2010-04-29 08:42:32 +0400
> message:
>   Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
>
>   Problem: "COM_FIELD_LIST is an old command of the MySQL server, before there was real move to only
>   SQL. Seems that the data sent to COM_FIELD_LIST( mysql_list_fields() function) is not
>   checked for sanity. By sending long data for the table a buffer is overflown, which can
>   be used deliberately to include code that harms".
>
>   Fix: check incoming data length.

The patch did not apply cleanly:
- Line numbers are completely off, roughly it is 2030 -> 1313
- What is called "pend" in the patch, is "arg_end" in the source.
---
 sql/sql_parse.cc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 5228a37f490..11481933c8a 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1300,8 +1300,16 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
       We have name + wildcard in packet, separated by endzero
     */
     arg_end= strend(packet);
+    uint arg_length= arg_end - packet;
+    
+    /* Check given table name length. */
+    if (arg_length >= packet_length || arg_length > NAME_LEN)
+    {
+      my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
+      break;
+    }
     thd->convert_string(&conv_name, system_charset_info,
-			packet, (uint) (arg_end - packet), thd->charset());
+			packet, arg_length, thd->charset());
     table_list.alias= table_list.table_name= conv_name.str;
     packet= arg_end + 1;
 

From fb8791e2bc36c3da93540b68d86ff1f2c3ddb2b2 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:51:35 +0200
Subject: [PATCH 10/14] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 1810.3987.14
> revision-id: davi.arnaut@sun.com-20100429132816-ictyul6d75itek22
> parent: ramil@mysql.com-20100429044232-f0pkyx8fnpszf142
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: 50974-5.0
> timestamp: Thu 2010-04-29 10:28:16 -0300
> message:
>   Bug#50974: Server keeps receiving big (> max_allowed_packet) packets indefinitely.
>
>   The server could be tricked to read packets indefinitely if it
>   received a packet larger than the maximum size of one packet.
>   This problem is aggravated by the fact that it can be triggered
>   before authentication.
>
>   The solution is to no skip big packets for non-authenticated
>   sessions. If a big packet is sent before a session is authen-
>   ticated, a error is returned and the connection is closed.

> ------------------------------------------------------------
> revno: 3363 [merge]
> revision-id: davi.arnaut@sun.com-20100429231819-i3anwzrdasjmezvt
> parent: davi.arnaut@sun.com-20100401131522-895y8uzvv8ag44gs
> parent: davi.arnaut@sun.com-20100429132816-ictyul6d75itek22
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: mysql-5.1-bugteam
> timestamp: Thu 2010-04-29 20:18:19 -0300
> message:
>   Manual merge.
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 include/mysql_com.h | 10 ++++++++++
 sql/net_serv.cc     |  4 ++++
 sql/sql_connect.cc  |  7 +++++++
 3 files changed, 21 insertions(+)

diff --git a/include/mysql_com.h b/include/mysql_com.h
index db5a5eb8741..7d3dd3d4f34 100644
--- a/include/mysql_com.h
+++ b/include/mysql_com.h
@@ -277,6 +277,16 @@ typedef struct st_net {
   /** Client library sqlstate buffer. Set along with the error message. */
   char sqlstate[SQLSTATE_LENGTH+1];
   void *extension;
+#if defined(MYSQL_SERVER) && !defined(EMBEDDED_LIBRARY)
+  /*
+    Controls whether a big packet should be skipped.
+
+    Initially set to FALSE by default. Unauthenticated sessions must have
+    this set to FALSE so that the server can't be tricked to read packets
+    indefinitely.
+  */
+  my_bool skip_big_packet;
+#endif
 } NET;
 
 
diff --git a/sql/net_serv.cc b/sql/net_serv.cc
index 73892f31ccf..15c0c581108 100644
--- a/sql/net_serv.cc
+++ b/sql/net_serv.cc
@@ -136,6 +136,9 @@ my_bool my_net_init(NET *net, Vio* vio)
 #else
   net->query_cache_query= 0;
 #endif
+#if defined(MYSQL_SERVER) && !defined(EMBEDDED_LIBRARY)
+  net->skip_big_packet= FALSE;
+#endif
 
   if (vio != 0)					/* If real connection */
   {
@@ -949,6 +952,7 @@ my_real_read(NET *net, size_t *complen)
 	  {
 #if defined(MYSQL_SERVER) && !defined(NO_ALARM)
 	    if (!net->compress &&
+                net->skip_big_packet &&
 		!my_net_skip_rest(net, (uint32) len, &alarmed, &alarm_buff))
 	      net->error= 3;		/* Successfully skiped packet */
 #endif
diff --git a/sql/sql_connect.cc b/sql/sql_connect.cc
index 16f11fe22c4..2039c7f7449 100644
--- a/sql/sql_connect.cc
+++ b/sql/sql_connect.cc
@@ -471,6 +471,13 @@ check_user(THD *thd, enum enum_server_command command,
       }
       my_ok(thd);
       thd->password= test(passwd_len);          // remember for error messages 
+      /*
+        Allow the network layer to skip big packets. Although a malicious
+        authenticated session might use this to trick the server to read
+        big packets indefinitely, this is a previously established behavior
+        that needs to be preserved as to not break backwards compatibility.
+      */
+      thd->net.skip_big_packet= TRUE;
       /* Ready to handle queries */
       DBUG_RETURN(0);
     }

From a0a850318b964ca92b660e0127c35061ad8f7a54 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:53:01 +0200
Subject: [PATCH 11/14] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3351.41.1
> revision-id: alexey.kopytov@sun.com-20100430111048-jdls6ofn4kkmpt09
> parent: sergey.glukhov@sun.com-20100329134249-03wyhzp5k92dzhcb
> committer: Alexey Kopytov <Alexey.Kopytov@Sun.com>
> branch nick: my51-bug48419
> timestamp: Fri 2010-04-30 15:10:48 +0400
> message:
>   Bug #48419: another explain crash..
>
>   WHERE predicates containing references to empty tables in a
>   subquery were handled incorrectly by the optimizer when
>   executing EXPLAIN. As a result, the optimizer could try to
>   evaluate such predicates rather than just stop with
>   "Impossible WHERE noticed after reading const tables" as
>   it would do in a non-subquery case. This led to valgrind
>   errors and crashes.
>
>   Fixed the code checking the above condition so that subqueries
>   are not excluded and hence are handled in the same way as top
>   level SELECTs.
---
 mysql-test/r/explain.result | 12 ++++++++++++
 mysql-test/r/ps.result      | 12 ++++++------
 mysql-test/t/explain.test   | 15 +++++++++++++++
 sql/sql_select.cc           |  3 +--
 4 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/mysql-test/r/explain.result b/mysql-test/r/explain.result
index b8db8b53e06..8f2d704b312 100644
--- a/mysql-test/r/explain.result
+++ b/mysql-test/r/explain.result
@@ -226,4 +226,16 @@ Warnings:
 Note	1276	Field or reference 'test.t1.c' of SELECT #2 was resolved in SELECT #1
 Note	1003	select (select 1 from `test`.`t2` where (`test`.`t2`.`d` = NULL)) AS `(SELECT 1 FROM t2 WHERE d = c)` from `test`.`t1`
 DROP TABLE t1, t2;
+#
+# Bug #48419: another explain crash..
+#
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2 (b BLOB, KEY b(b(100)));
+INSERT INTO t2 VALUES ('1'), ('2'), ('3');
+FLUSH TABLES;
+EXPLAIN SELECT 1 FROM t1 WHERE a = (SELECT 1 FROM t1 t JOIN t2 WHERE b <= 1 AND t.a);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+2	SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+DROP TABLE t1, t2;
 End of 5.1 tests.
diff --git a/mysql-test/r/ps.result b/mysql-test/r/ps.result
index cf08d763e5c..84b9cdf930c 100644
--- a/mysql-test/r/ps.result
+++ b/mysql-test/r/ps.result
@@ -155,24 +155,24 @@ execute stmt1 ;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 execute stmt1 ;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 explain SELECT (SELECT SUM(c1 + c12 + 0.0) FROM t2 where (t1.c2 - 0e-3) = t2.c2 GROUP BY t1.c15 LIMIT 1) as scalar_s, exists (select 1.0e+0 from t2 where t2.c3 * 9.0000000000 = t1.c4) as exists_s, c5 * 4 in (select c6 + 0.3e+1 from t2) as in_s, (c7 - 4, c8 - 4) in (select c9 + 4.0, c10 + 40e-1 from t2) as in_row_s FROM t1, (select c25 x, c32 y from t2) tt WHERE x * 1 = c25;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 deallocate prepare stmt1;
diff --git a/mysql-test/t/explain.test b/mysql-test/t/explain.test
index 3c2f7bbbe96..ba6be72dbdc 100644
--- a/mysql-test/t/explain.test
+++ b/mysql-test/t/explain.test
@@ -198,4 +198,19 @@ INSERT INTO t2 VALUES (NULL), (0);
 EXPLAIN EXTENDED SELECT (SELECT 1 FROM t2 WHERE d = c) FROM t1;
 DROP TABLE t1, t2;
 
+
+--echo #
+--echo # Bug #48419: another explain crash..
+--echo #
+
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2 (b BLOB, KEY b(b(100)));
+INSERT INTO t2 VALUES ('1'), ('2'), ('3');
+
+FLUSH TABLES;
+
+EXPLAIN SELECT 1 FROM t1 WHERE a = (SELECT 1 FROM t1 t JOIN t2 WHERE b <= 1 AND t.a);
+
+DROP TABLE t1, t2;
+
 --echo End of 5.1 tests.
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index a426f4b68a1..291432c2bb6 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -1107,8 +1107,7 @@ JOIN::optimize()
   }
 
   if (conds && const_table_map != found_const_table_map &&
-      (select_options & SELECT_DESCRIBE) &&
-      select_lex->master_unit() == &thd->lex->unit) // upper level SELECT
+      (select_options & SELECT_DESCRIBE))
   {
     conds=new Item_int((longlong) 0,1);	// Always false
   }

From c658c3ed34b99e8fef0c41898ad295b1223071f3 Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:03:22 +0200
Subject: [PATCH 12/14] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3367 [merge]
> revision-id: joro@sun.com-20100504140328-srxf3c088j2twnq6
> parent: kristofer.pettersson@sun.com-20100503172109-f9hracq5pqsaomb1
> parent: joro@sun.com-20100503151651-nakknn8amrapmdp7
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B53371-5.1-bugteam
> timestamp: Tue 2010-05-04 17:03:28 +0300
> message:
>   Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
>
>   This is the 5.1 merge and extension of the fix.
>   The server was happily accepting paths in table name in all places a table
>   name is accepted (e.g. a SELECT). This allowed all users that have some
>   privilege over some database to read all tables in all databases in all
>   mysql server instances that the server file system has access to.
>   Fixed by :
>   1. making sure no path elements are allowed in quoted table name when
>   constructing the path (note that the path symbols are still valid in table names
>   when they're properly escaped by the server).
>   2. checking the #mysql50# prefixed names the same way they're checked for
>   path elements in mysql-5.0.
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 mysql-test/r/grant.result | 16 ++++++++++++++
 mysql-test/t/grant.test   | 25 ++++++++++++++++++++++
 sql/mysql_priv.h          |  2 +-
 sql/partition_info.cc     |  4 ++--
 sql/sql_parse.cc          |  9 +++++++-
 sql/sql_table.cc          | 14 ++++++++++++
 sql/sql_yacc.yy           |  2 +-
 sql/table.cc              | 29 ++++++++++++++++++++++---
 tests/mysql_client_test.c | 45 +++++++++++++++++++++++++++++++++++++++
 9 files changed, 138 insertions(+), 8 deletions(-)

diff --git a/mysql-test/r/grant.result b/mysql-test/r/grant.result
index 92beccd2a9e..6831ef6183d 100644
--- a/mysql-test/r/grant.result
+++ b/mysql-test/r/grant.result
@@ -1413,3 +1413,19 @@ DROP USER 'user1';
 DROP USER 'user1'@'localhost';
 DROP USER 'user2';
 DROP DATABASE db1;
+CREATE DATABASE db1;
+CREATE DATABASE db2;
+GRANT SELECT ON db1.* to 'testbug'@localhost;
+USE db2;
+CREATE TABLE t1 (a INT);
+USE test;
+SELECT * FROM `../db2/tb2`;
+ERROR 42S02: Table 'db1.../db2/tb2' doesn't exist
+SELECT * FROM `../db2`.tb2;
+ERROR 42000: SELECT command denied to user 'testbug'@'localhost' for table 'tb2'
+SELECT * FROM `#mysql50#/../db2/tb2`;
+ERROR 42S02: Table 'db1.#mysql50#/../db2/tb2' doesn't exist
+DROP USER 'testbug'@localhost;
+DROP TABLE db2.t1;
+DROP DATABASE db1;
+DROP DATABASE db2;
diff --git a/mysql-test/t/grant.test b/mysql-test/t/grant.test
index bcd393bd6ab..cb8d3c63be8 100644
--- a/mysql-test/t/grant.test
+++ b/mysql-test/t/grant.test
@@ -1525,5 +1525,30 @@ DROP USER 'user1'@'localhost';
 DROP USER 'user2';
 DROP DATABASE db1;
 
+
+#
+# Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
+#
+
+CREATE DATABASE db1;
+CREATE DATABASE db2;
+GRANT SELECT ON db1.* to 'testbug'@localhost;
+USE db2;
+CREATE TABLE t1 (a INT);
+USE test;
+connect (con1,localhost,testbug,,db1);
+--error ER_NO_SUCH_TABLE
+SELECT * FROM `../db2/tb2`;
+--error ER_TABLEACCESS_DENIED_ERROR
+SELECT * FROM `../db2`.tb2;
+--error ER_NO_SUCH_TABLE
+SELECT * FROM `#mysql50#/../db2/tb2`;
+connection default;
+disconnect con1;
+DROP USER 'testbug'@localhost;
+DROP TABLE db2.t1;
+DROP DATABASE db1;
+DROP DATABASE db2;
+
 # Wait till we reached the initial number of concurrent sessions
 --source include/wait_until_count_sessions.inc
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 56175d069c5..3ecbef4d456 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -2263,7 +2263,7 @@ void update_create_info_from_table(HA_CREATE_INFO *info, TABLE *form);
 int rename_file_ext(const char * from,const char * to,const char * ext);
 bool check_db_name(LEX_STRING *db);
 bool check_column_name(const char *name);
-bool check_table_name(const char *name, uint length);
+bool check_table_name(const char *name, uint length, bool check_for_path_chars);
 char *get_field(MEM_ROOT *mem, Field *field);
 bool get_field(MEM_ROOT *mem, Field *field, class String *res);
 int wild_case_compare(CHARSET_INFO *cs, const char *str,const char *wildstr);
diff --git a/sql/partition_info.cc b/sql/partition_info.cc
index ba9ea0e876e..6e2f7dfad26 100644
--- a/sql/partition_info.cc
+++ b/sql/partition_info.cc
@@ -972,7 +972,7 @@ bool partition_info::check_partition_info(THD *thd, handlerton **eng_type,
           part_elem->engine_type= default_engine_type;
         }
         if (check_table_name(part_elem->partition_name,
-                             strlen(part_elem->partition_name)))
+                             strlen(part_elem->partition_name), FALSE))
         {
           my_error(ER_WRONG_PARTITION_NAME, MYF(0));
           goto end;
@@ -990,7 +990,7 @@ bool partition_info::check_partition_info(THD *thd, handlerton **eng_type,
         {
           sub_elem= sub_it++;
           if (check_table_name(sub_elem->partition_name,
-                               strlen(sub_elem->partition_name)))
+                               strlen(sub_elem->partition_name), FALSE))
           {
             my_error(ER_WRONG_PARTITION_NAME, MYF(0));
             goto end;
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 11481933c8a..93d80164ffb 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1310,6 +1310,13 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
     }
     thd->convert_string(&conv_name, system_charset_info,
 			packet, arg_length, thd->charset());
+    if (check_table_name(conv_name.str, conv_name.length, FALSE))
+    {
+      /* this is OK due to convert_string() null-terminating the string */
+      my_error(ER_WRONG_TABLE_NAME, MYF(0), conv_name.str);
+      break;
+    }
+
     table_list.alias= table_list.table_name= conv_name.str;
     packet= arg_end + 1;
 
@@ -6233,7 +6240,7 @@ TABLE_LIST *st_select_lex::add_table_to_list(THD *thd,
     DBUG_RETURN(0);				// End of memory
   alias_str= alias ? alias->str : table->table.str;
   if (!test(table_options & TL_OPTION_ALIAS) && 
-      check_table_name(table->table.str, table->table.length))
+      check_table_name(table->table.str, table->table.length, FALSE))
   {
     my_error(ER_WRONG_TABLE_NAME, MYF(0), table->table.str);
     DBUG_RETURN(0);
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index ad72cab664e..84e6c721d72 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -435,7 +435,21 @@ uint tablename_to_filename(const char *from, char *to, uint to_length)
   DBUG_PRINT("enter", ("from '%s'", from));
 
   if ((length= check_n_cut_mysql50_prefix(from, to, to_length)))
+  {
+    /*
+      Check if the name supplied is a valid mysql 5.0 name and 
+      make the name a zero length string if it's not.
+      Note that just returning zero length is not enough : 
+      a lot of places don't check the return value and expect 
+      a zero terminated string.
+    */  
+    if (check_table_name(to, length, TRUE))
+    {
+      to[0]= 0;
+      length= 0;
+    }
     DBUG_RETURN(length);
+  }
   length= strconvert(system_charset_info, from,
                      &my_charset_filename, to, to_length, &errors);
   if (check_if_legal_tablename(to) &&
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index 4f43ab8bebd..f815da006b1 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -6133,7 +6133,7 @@ alter_list_item:
             {
               MYSQL_YYABORT;
             }
-            if (check_table_name($3->table.str,$3->table.length) ||
+            if (check_table_name($3->table.str,$3->table.length, FALSE) ||
                 ($3->db.str && check_db_name(&$3->db)))
             {
               my_error(ER_WRONG_TABLE_NAME, MYF(0), $3->table.str);
diff --git a/sql/table.cc b/sql/table.cc
index a4e2c59fb87..04d7b3a8d0a 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -494,6 +494,26 @@ inline bool is_system_table_name(const char *name, uint length)
 }
 
 
+/**
+  Check if a string contains path elements
+*/  
+
+static inline bool has_disabled_path_chars(const char *str)
+{
+  for (; *str; str++)
+    switch (*str)
+    {
+      case FN_EXTCHAR:
+      case '/':
+      case '\\':
+      case '~':
+      case '@':
+        return TRUE;
+    }
+  return FALSE;
+}
+
+
 /*
   Read table definition from a binary / text based .frm file
   
@@ -549,7 +569,8 @@ int open_table_def(THD *thd, TABLE_SHARE *share, uint db_flags)
         This kind of tables must have been opened only by the
         my_open() above.
     */
-    if (strchr(share->table_name.str, '@') ||
+    if (has_disabled_path_chars(share->table_name.str) ||
+        has_disabled_path_chars(share->db.str) ||
         !strncmp(share->db.str, MYSQL50_TABLE_NAME_PREFIX,
                  MYSQL50_TABLE_NAME_PREFIX_LENGTH) ||
         !strncmp(share->table_name.str, MYSQL50_TABLE_NAME_PREFIX,
@@ -2711,7 +2732,6 @@ bool check_db_name(LEX_STRING *org_name)
             (name_length > NAME_CHAR_LEN)); /* purecov: inspected */
 }
 
-
 /*
   Allow anything as a table name, as long as it doesn't contain an
   ' ' at the end
@@ -2719,7 +2739,7 @@ bool check_db_name(LEX_STRING *org_name)
 */
 
 
-bool check_table_name(const char *name, uint length)
+bool check_table_name(const char *name, uint length, bool check_for_path_chars)
 {
   uint name_length= 0;  // name length in symbols
   const char *end= name+length;
@@ -2746,6 +2766,9 @@ bool check_table_name(const char *name, uint length)
         continue;
       }
     }
+    if (check_for_path_chars &&
+        (*name == '/' || *name == '\\' || *name == '~' || *name == FN_EXTCHAR))
+      return 1;
 #endif
     name++;
     name_length++;
diff --git a/tests/mysql_client_test.c b/tests/mysql_client_test.c
index f65e549fd96..b99461ecd06 100644
--- a/tests/mysql_client_test.c
+++ b/tests/mysql_client_test.c
@@ -18049,6 +18049,50 @@ static void test_bug44495()
   DBUG_VOID_RETURN;
 }
 
+static void test_bug53371()
+{
+  int rc;
+  MYSQL_RES *result;
+
+  myheader("test_bug53371");
+
+  rc= mysql_query(mysql, "DROP TABLE IF EXISTS t1");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP DATABASE IF EXISTS bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP USER 'testbug'@localhost");
+
+  rc= mysql_query(mysql, "CREATE TABLE t1 (a INT)");
+  myquery(rc);
+  rc= mysql_query(mysql, "CREATE DATABASE bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "GRANT SELECT ON bug53371.* to 'testbug'@localhost");
+  myquery(rc);
+
+  rc= mysql_change_user(mysql, "testbug", NULL, "bug53371");
+  myquery(rc);
+
+  rc= mysql_query(mysql, "SHOW COLUMNS FROM client_test_db.t1");
+  DIE_UNLESS(rc);
+  DIE_UNLESS(mysql_errno(mysql) == 1142);
+
+  result= mysql_list_fields(mysql, "../client_test_db/t1", NULL);
+  DIE_IF(result);
+
+  result= mysql_list_fields(mysql, "#mysql50#/../client_test_db/t1", NULL);
+  DIE_IF(result);
+
+  rc= mysql_change_user(mysql, opt_user, opt_password, current_db);
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP TABLE t1");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP DATABASE bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP USER 'testbug'@localhost");
+  myquery(rc);
+}
+
+
 /*
   Read and parse arguments and MySQL options from my.cnf
 */
@@ -18358,6 +18402,7 @@ static struct my_tests_st my_tests[]= {
   { "test_bug30472", test_bug30472 },
   { "test_bug20023", test_bug20023 },
   { "test_bug45010", test_bug45010 },
+  { "test_bug53371", test_bug53371 },
   { "test_bug31418", test_bug31418 },
   { "test_bug31669", test_bug31669 },
   { "test_bug28386", test_bug28386 },

From 12c4c7a0ee06685e727d1fb0b8d6d5560a732816 Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:14:23 +0200
Subject: [PATCH 13/14] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3386
> revision-id: sergey.glukhov@sun.com-20100518082821-yajhvbv1ghmlpu1n
> parent: aelkin@mysql.com-20100516170332-x8priwrdjwolc065
> committer: Sergey Glukhov <Sergey.Glukhov@sun.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Tue 2010-05-18 13:28:21 +0500
> message:
>   Bug#48729 SELECT ... FROM INFORMATION_SCHEMA.ROUTINES causes memory to grow
>   Analysis showed that in case of accessing I_S table
>   ROUTINES we perform unnecessary allocations
>   with get_field() function for every processed row that
>   in their turn causes significant memory growth.
>   the fix is to avoid use of get_field().
---
 sql/sql_show.cc | 74 ++++++++++++++++++++++++-------------------------
 1 file changed, 37 insertions(+), 37 deletions(-)

diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index cb60027842d..b4881125b14 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -4180,24 +4180,37 @@ int fill_schema_coll_charset_app(THD *thd, TABLE_LIST *tables, COND *cond)
 }
 
 
+static inline void copy_field_as_string(Field *to_field, Field *from_field)
+{
+  char buff[MAX_FIELD_WIDTH];
+  String tmp_str(buff, sizeof(buff), system_charset_info);
+  from_field->val_str(&tmp_str);
+  to_field->store(tmp_str.ptr(), tmp_str.length(), system_charset_info);
+}
+
+
 bool store_schema_proc(THD *thd, TABLE *table, TABLE *proc_table,
                        const char *wild, bool full_access, const char *sp_user)
 {
-  String tmp_string;
-  String sp_db, sp_name, definer;
   MYSQL_TIME time;
   LEX *lex= thd->lex;
   CHARSET_INFO *cs= system_charset_info;
-  get_field(thd->mem_root, proc_table->field[0], &sp_db);
-  get_field(thd->mem_root, proc_table->field[1], &sp_name);
-  get_field(thd->mem_root, proc_table->field[11], &definer);
+  char sp_db_buff[NAME_LEN + 1], sp_name_buff[NAME_LEN + 1],
+    definer_buff[USERNAME_LENGTH + HOSTNAME_LENGTH + 2];
+  String sp_db(sp_db_buff, sizeof(sp_db_buff), cs);
+  String sp_name(sp_name_buff, sizeof(sp_name_buff), cs);
+  String definer(definer_buff, sizeof(definer_buff), cs);
+
+  proc_table->field[0]->val_str(&sp_db);
+  proc_table->field[1]->val_str(&sp_name);
+  proc_table->field[11]->val_str(&definer);
+
   if (!full_access)
-    full_access= !strcmp(sp_user, definer.ptr());
-  if (!full_access && check_some_routine_access(thd, sp_db.ptr(),
-                                                sp_name.ptr(),
-                                                proc_table->field[2]->
-                                                val_int() ==
-                                                TYPE_ENUM_PROCEDURE))
+    full_access= !strcmp(sp_user, definer.c_ptr_safe());
+  if (!full_access &&
+      check_some_routine_access(thd, sp_db.c_ptr_safe(), sp_name.c_ptr_safe(),
+                                proc_table->field[2]->val_int() ==
+                                TYPE_ENUM_PROCEDURE))
     return 0;
 
   if ((lex->sql_command == SQLCOM_SHOW_STATUS_PROC &&
@@ -4207,55 +4220,42 @@ bool store_schema_proc(THD *thd, TABLE *table, TABLE *proc_table,
       (sql_command_flags[lex->sql_command] & CF_STATUS_COMMAND) == 0)
   {
     restore_record(table, s->default_values);
-    if (!wild || !wild[0] || !wild_compare(sp_name.ptr(), wild, 0))
+    if (!wild || !wild[0] || !wild_compare(sp_name.c_ptr_safe(), wild, 0))
     {
       int enum_idx= (int) proc_table->field[5]->val_int();
       table->field[3]->store(sp_name.ptr(), sp_name.length(), cs);
-      get_field(thd->mem_root, proc_table->field[3], &tmp_string);
-      table->field[0]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[0], proc_table->field[3]);
       table->field[2]->store(sp_db.ptr(), sp_db.length(), cs);
-      get_field(thd->mem_root, proc_table->field[2], &tmp_string);
-      table->field[4]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[4], proc_table->field[2]);
       if (proc_table->field[2]->val_int() == TYPE_ENUM_FUNCTION)
       {
-        get_field(thd->mem_root, proc_table->field[9], &tmp_string);
-        table->field[5]->store(tmp_string.ptr(), tmp_string.length(), cs);
+        copy_field_as_string(table->field[5], proc_table->field[9]);
         table->field[5]->set_notnull();
       }
       if (full_access)
       {
-        get_field(thd->mem_root, proc_table->field[19], &tmp_string);
-        table->field[7]->store(tmp_string.ptr(), tmp_string.length(), cs);
+        copy_field_as_string(table->field[7], proc_table->field[19]);
         table->field[7]->set_notnull();
       }
       table->field[6]->store(STRING_WITH_LEN("SQL"), cs);
       table->field[10]->store(STRING_WITH_LEN("SQL"), cs);
-      get_field(thd->mem_root, proc_table->field[6], &tmp_string);
-      table->field[11]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[11], proc_table->field[6]);
       table->field[12]->store(sp_data_access_name[enum_idx].str, 
                               sp_data_access_name[enum_idx].length , cs);
-      get_field(thd->mem_root, proc_table->field[7], &tmp_string);
-      table->field[14]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[14], proc_table->field[7]);
+
       bzero((char *)&time, sizeof(time));
       ((Field_timestamp *) proc_table->field[12])->get_time(&time);
       table->field[15]->store_time(&time, MYSQL_TIMESTAMP_DATETIME);
       bzero((char *)&time, sizeof(time));
       ((Field_timestamp *) proc_table->field[13])->get_time(&time);
       table->field[16]->store_time(&time, MYSQL_TIMESTAMP_DATETIME);
-      get_field(thd->mem_root, proc_table->field[14], &tmp_string);
-      table->field[17]->store(tmp_string.ptr(), tmp_string.length(), cs);
-      get_field(thd->mem_root, proc_table->field[15], &tmp_string);
-      table->field[18]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[17], proc_table->field[14]);
+      copy_field_as_string(table->field[18], proc_table->field[15]);
       table->field[19]->store(definer.ptr(), definer.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[16], &tmp_string);
-      table->field[20]->store(tmp_string.ptr(), tmp_string.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[17], &tmp_string);
-      table->field[21]->store(tmp_string.ptr(), tmp_string.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[18], &tmp_string);
-      table->field[22]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[20], proc_table->field[16]);
+      copy_field_as_string(table->field[21], proc_table->field[17]);
+      copy_field_as_string(table->field[22], proc_table->field[18]);
 
       return schema_table_store_record(thd, table);
     }

From 1c87c8b1eeaf06e77a2651bbff80ec1a0170547d Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:22:05 +0200
Subject: [PATCH 14/14] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3392.1.1
> revision-id: gshchepa@mysql.com-20100521184732-0jvpzinv0uwyvr2d
> parent: sven.sandberg@sun.com-20100520153801-yyhujm1qqa4eyfn0
> committer: Gleb Shchepa <gshchepa@mysql.com>
> branch nick: 53804-5.1
> timestamp: Fri 2010-05-21 22:47:32 +0400
> message:
>   Bug #53804: serious flaws in the alter database .. upgrade
>               data directory name command
>
>   The check_db_name function has been modified to validate tails of
>   #mysql50#-prefixed database names for compliance with MySQL 5.0
>   database name encoding rules (the check_table_name function call
>   has been reused).
---
 mysql-test/r/renamedb.result |  2 +-
 mysql-test/r/upgrade.result  | 28 ++++++++++++++++++++++++++++
 mysql-test/t/renamedb.test   |  2 +-
 mysql-test/t/upgrade.test    | 34 ++++++++++++++++++++++++++++++++++
 sql/mysql_priv.h             |  1 +
 sql/sql_table.cc             | 23 ++++++++++++++++++++---
 sql/table.cc                 | 34 ++++++++++------------------------
 7 files changed, 95 insertions(+), 29 deletions(-)

diff --git a/mysql-test/r/renamedb.result b/mysql-test/r/renamedb.result
index ff8f89592fc..e77aca0d0b7 100644
--- a/mysql-test/r/renamedb.result
+++ b/mysql-test/r/renamedb.result
@@ -7,6 +7,6 @@ ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and n
 ALTER DATABASE `#mysql51#not-yet` UPGRADE DATA DIRECTORY NAME;
 ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and name
 ALTER DATABASE `#mysql50#` UPGRADE DATA DIRECTORY NAME;
-ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and name
+ERROR 42000: Incorrect database name '#mysql50#'
 ALTER DATABASE `#mysql50#upgrade-me` UPGRADE DATA DIRECTORY NAME;
 ERROR 42000: Unknown database '#mysql50#upgrade-me'
diff --git a/mysql-test/r/upgrade.result b/mysql-test/r/upgrade.result
index 034242079b1..da2f55b5bb1 100644
--- a/mysql-test/r/upgrade.result
+++ b/mysql-test/r/upgrade.result
@@ -112,3 +112,31 @@ select * from `a-b-c`.v1;
 f1
 drop database `a-b-c`;
 use test;
+# End of 5.0 tests
+#
+# Bug #53804: serious flaws in the alter database .. upgrade data
+#             directory name command
+#
+ALTER DATABASE `#mysql50#:` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Unknown database '#mysql50#:'
+ALTER DATABASE `#mysql50#.` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#.'
+ALTER DATABASE `#mysql50#../` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../'
+ALTER DATABASE `#mysql50#../..` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../..'
+ALTER DATABASE `#mysql50#../../` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../../'
+ALTER DATABASE `#mysql50#./blablabla` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#./blablabla'
+ALTER DATABASE `#mysql50#../blablabla` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../blablabla'
+ALTER DATABASE `#mysql50#/` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#/'
+ALTER DATABASE `#mysql50#/.` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#/.'
+USE `#mysql50#.`;
+ERROR 42000: Incorrect database name '#mysql50#.'
+USE `#mysql50#../blablabla`;
+ERROR 42000: Incorrect database name '#mysql50#../blablabla'
+# End of 5.1 tests
diff --git a/mysql-test/t/renamedb.test b/mysql-test/t/renamedb.test
index 84315090b7a..71d0c127058 100644
--- a/mysql-test/t/renamedb.test
+++ b/mysql-test/t/renamedb.test
@@ -44,7 +44,7 @@ ALTER DATABASE `#mysql41#not-supported` UPGRADE DATA DIRECTORY NAME;
 --error ER_WRONG_USAGE
 ALTER DATABASE `#mysql51#not-yet` UPGRADE DATA DIRECTORY NAME;
 
---error ER_WRONG_USAGE
+--error ER_WRONG_DB_NAME
 ALTER DATABASE `#mysql50#` UPGRADE DATA DIRECTORY NAME;
 
 --error ER_BAD_DB_ERROR
diff --git a/mysql-test/t/upgrade.test b/mysql-test/t/upgrade.test
index e390e8a1253..a7b9a1531ff 100644
--- a/mysql-test/t/upgrade.test
+++ b/mysql-test/t/upgrade.test
@@ -137,3 +137,37 @@ select * from `a-b-c`.v1;
 --enable_ps_protocol
 drop database `a-b-c`;
 use test;
+
+--echo # End of 5.0 tests
+
+--echo #
+--echo # Bug #53804: serious flaws in the alter database .. upgrade data
+--echo #             directory name command
+--echo #
+
+--error ER_BAD_DB_ERROR
+ALTER DATABASE `#mysql50#:` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#.` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../..` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../../` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#./blablabla` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../blablabla` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#/` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#/.` UPGRADE DATA DIRECTORY NAME;
+
+--error ER_WRONG_DB_NAME
+USE `#mysql50#.`;
+--error ER_WRONG_DB_NAME
+USE `#mysql50#../blablabla`;
+
+--echo # End of 5.1 tests
+
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 3ecbef4d456..30f3a1af437 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -2287,6 +2287,7 @@ uint explain_filename(THD* thd, const char *from, char *to, uint to_length,
 uint filename_to_tablename(const char *from, char *to, uint to_length);
 uint tablename_to_filename(const char *from, char *to, uint to_length);
 uint check_n_cut_mysql50_prefix(const char *from, char *to, uint to_length);
+bool check_mysql50_prefix(const char *name);
 #endif /* MYSQL_SERVER || INNODB_COMPATIBILITY_HOOKS */
 #ifdef MYSQL_SERVER
 uint build_table_filename(char *buff, size_t bufflen, const char *db,
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 84e6c721d72..babc025db87 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -391,6 +391,25 @@ uint filename_to_tablename(const char *from, char *to, uint to_length)
 }
 
 
+/**
+  Check if given string begins with "#mysql50#" prefix
+  
+  @param   name          string to check cut 
+  
+  @retval
+    FALSE  no prefix found
+  @retval
+    TRUE   prefix found
+*/
+
+bool check_mysql50_prefix(const char *name)
+{
+  return (name[0] == '#' && 
+         !strncmp(name, MYSQL50_TABLE_NAME_PREFIX,
+                  MYSQL50_TABLE_NAME_PREFIX_LENGTH));
+}
+
+
 /**
   Check if given string begins with "#mysql50#" prefix, cut it if so.
   
@@ -406,9 +425,7 @@ uint filename_to_tablename(const char *from, char *to, uint to_length)
 
 uint check_n_cut_mysql50_prefix(const char *from, char *to, uint to_length)
 {
-  if (from[0] == '#' && 
-      !strncmp(from, MYSQL50_TABLE_NAME_PREFIX,
-               MYSQL50_TABLE_NAME_PREFIX_LENGTH))
+  if (check_mysql50_prefix(from))
     return (uint) (strmake(to, from + MYSQL50_TABLE_NAME_PREFIX_LENGTH,
                            to_length - 1) - to);
   return 0;
diff --git a/sql/table.cc b/sql/table.cc
index 04d7b3a8d0a..23d41760495 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -2701,44 +2701,30 @@ bool check_db_name(LEX_STRING *org_name)
 {
   char *name= org_name->str;
   uint name_length= org_name->length;
+  bool check_for_path_chars;
 
   if (!name_length || name_length > NAME_LEN)
     return 1;
 
+  if ((check_for_path_chars= check_mysql50_prefix(name)))
+  {
+    name+= MYSQL50_TABLE_NAME_PREFIX_LENGTH;
+    name_length-= MYSQL50_TABLE_NAME_PREFIX_LENGTH;
+  }
+
   if (lower_case_table_names && name != any_db)
     my_casedn_str(files_charset_info, name);
 
-#if defined(USE_MB) && defined(USE_MB_IDENT)
-  if (use_mb(system_charset_info))
-  {
-    name_length= 0;
-    bool last_char_is_space= TRUE;
-    char *end= name + org_name->length;
-    while (name < end)
-    {
-      int len;
-      last_char_is_space= my_isspace(system_charset_info, *name);
-      len= my_ismbchar(system_charset_info, name, end);
-      if (!len)
-        len= 1;
-      name+= len;
-      name_length++;
-    }
-    return (last_char_is_space || name_length > NAME_CHAR_LEN);
-  }
-  else
-#endif
-    return ((org_name->str[org_name->length - 1] != ' ') ||
-            (name_length > NAME_CHAR_LEN)); /* purecov: inspected */
+  return check_table_name(name, name_length, check_for_path_chars);
 }
 
+
 /*
   Allow anything as a table name, as long as it doesn't contain an
   ' ' at the end
   returns 1 on error
 */
 
-
 bool check_table_name(const char *name, uint length, bool check_for_path_chars)
 {
   uint name_length= 0;  // name length in symbols
@@ -2766,10 +2752,10 @@ bool check_table_name(const char *name, uint length, bool check_for_path_chars)
         continue;
       }
     }
+#endif
     if (check_for_path_chars &&
         (*name == '/' || *name == '\\' || *name == '~' || *name == FN_EXTCHAR))
       return 1;
-#endif
     name++;
     name_length++;
   }