The problem could be demonstrated with an outer join of two single-row
tables where the values of the join attributes were null. Any query
with such a join could return a wrong result set if the where
condition of the query was not empty. For queries with empty
where conditions the result sets were correct.
This was the consequence of two bugs in the code:
- Item_equal objects for on conditions of outer joins were
not built if the processed query had no where condition
- the check for null values in the code that evaluated constant
Item_equal objects was incorrect.
Fixed both above problems.
Added a test case for the bug and adjusted results for some other
test cases.
When not-exists optimization was applied to a table that
happened to be an inner table of two outer joins, one
embedded into another, then setting the match flag for
the embedding outer join on could be skipped. This caused
generation of extra null complemented rows.
Made sure that the match flags are set correctly in all cases
when not-exists optimization is used.
Don't do UNDO or REDO on a crashed table.
More DBUG_PRINT
sql/sql_parse.cc:
Remove display of 'packet' which is not useful
storage/maria/ma_blockrec.c:
More DBUG_PRINT()
storage/maria/ma_key_recover.c:
Write page number instead of page position
storage/maria/ma_recovery.c:
Write message to stderr if recovery is not likely to succeed because we don't log records for batch inserts.
In normal cases this should never be an issue as we would recreate an empty table if MariaDB dies under batch insert.
This warning will be given if you remove all tables and try to recreate them with maria_read_log, which can't be done as
the log doesn't contain all data.
Don't do UNDO or REDO on a crashed table.
storage/maria/ma_write.c:
Write page number instead of page position.
Fixed typo that caused warnings from mysql-test-run
mysql-test/mysql-test-run.pl:
Fixed typo
sql/mysqld.cc:
Give a more precise warning why something fails.
Fixed test failures in buildbot
Don't write errors when failing to send ok packet
mysql-test/suite/pbxt/r/range.result:
Don't write number of rows as it varies.
mysql-test/suite/pbxt/t/range.test:
Don't write number of rows as it varies.
sql/mysqld.cc:
Don't write errors when failing to send ok packet
storage/maria/ma_bitmap.c:
Added DBUG_ASSERT to detect wrong bitmap pages
storage/maria/ma_blockrec.c:
Don't reset BLOCKUSED_USE_ORG_BITMAP flag. This fixed a bug where bitmap could be wrong after UNDO of row with blobs
Fixed bug in Aria when replacing short keys with long keys and a key tree both overflow and underflow at same time.
Fixed several bugs when generating recovery logs when using RGQ with replacing long keys with short keys and vice versa.
Lots of new DBUG_ASSERT()'s
Added more information to recovery log to make it easier to know from where log entry orginated.
Introduced MARIA_PAGE->org_size that tells what the size of the page was in last log entry. This allows us to find out if all key changes for index page was logged.
Small code cleanups:
- Introduced _ma_log_key_changes() to log crc of key page changes
- Added share->max_index_block_size as max size of data one can put in key block (block_size - KEYPAGE_CHECKSUM_SIZE)
This will later simplify adding a directory to index pages.
- Write page number instead of page postition to DBUG log
mysql-test/lib/v1/mysql-test-run.pl:
Use --general-log instead of --log to disable warning when using RQG
sql/mysqld.cc:
If we have already sent ok to client when we get an error, log this to stderr
Don't disable option --log-output if CSV engine is not supported.
storage/maria/ha_maria.cc:
Log queries to recovery log also in LOCK TABLES
storage/maria/ma_check.c:
If param->max_trid is set, use this value instead of max_trid_in_system().
This is used by recovery to set max_trid to max seen trid so far.
keyinfo->block_length - KEYPAGE_CHECKSUM_SIZE -> max_index_block_size (Style optimization)
storage/maria/ma_delete.c:
Mark tables crashed early
Write page number instead of page position to debug log.
Added parameter to ma_log_delete() and ma_log_prefix() that is logged so that we can find where wrong log entries where generated.
Fixed bug where a page was not proplerly written when same key tree had both an overflow and underflow when deleting a key.
keyinfo->block_length - KEYPAGE_CHECKSUM_SIZE => max_index_block_size (Style optimization)
ma_log_delete() now has extra parameter of how many bytes from end of page should be appended to log for page (for page overflows)
storage/maria/ma_key_recover.c:
Added extra parameter to ma_log_prefix() to indicate what caused log entry.
Update MARIA_PAGE->org_size when logging info about page.
Much more DBUG_ASSERT()'s.
Fix some bugs in maria_log_add() to handle page overflows.
Added _ma_log_key_changes() to log crc of key page changes.
If EXTRA_STORE_FULL_PAGE_IN_KEY_CHANGES is defines, log the resulting pages to log so one can trivally
see how the resulting page should have looked like (for errors in CRC values)
storage/maria/ma_key_recover.h:
Added _ma_log_key_changes() which is only called if EXTRA_DEBUG_KEY_CHANGES is defined.
Updated function prototypes.
storage/maria/ma_loghandler.h:
Added more values to en_key_debug, to get more exact location where things went wrong when logging to recovery log.
storage/maria/ma_open.c:
Initialize share->max_index_block_size
storage/maria/ma_page.c:
Added updating and testing of MARIA_PAGE->org_size
Write page number instead of page postition to DBUG log
Generate error if we read page with wrong data.
Removed wrong assert: key_del_current != share->state.key_del.
Simplify _ma_log_compact_keypage()
storage/maria/ma_recovery.c:
Set param.max_trid to max seen trid before running repair table (used for alter table to create index)
storage/maria/ma_rt_key.c:
Update call to _ma_log_delete()
storage/maria/ma_rt_split.c:
Use _ma_log_key_changes()
Update MARIA_PAGE->org_size
storage/maria/ma_unique.c:
Remove casts
storage/maria/ma_write.c:
keyinfo->block_length - KEYPAGE_CHECKSUM_SIZE => share->max_index_block_length.
Updated calls to _ma_log_prefix()
Changed code to use _ma_log_key_changes()
Update ma_page->org_size
Fixed bug in _ma_log_split() for pages that overflow
Added KEY_OP_DEBUG logging to functions
Log KEYPAGE_FLAG in all log entries
storage/maria/maria_def.h:
Added SHARE->max_index_block_size
Added MARIA_PAGE->org_size
storage/maria/trnman.c:
Reset flags for new transaction.
Made long file names from previous patch shorter
mysql-test/r/archive.result:
Added testing of repair (for upgrade) of 5.0 tables.
mysql-test/std_data/archive_5_0.ARM:
Archive table created in MySQL 5.0
mysql-test/std_data/archive_5_0.ARZ:
Archive table created in MySQL 5.0
mysql-test/std_data/archive_5_0.frm:
Archive table created in MySQL 5.0
mysql-test/std_data/long_table_name.MYD:
Made long file names shorter
mysql-test/std_data/long_table_name.MYI:
Made long file names shorter
mysql-test/std_data/long_table_name.frm:
Made long file names shorter
mysql-test/t/archive.test:
Added testing of repair (for upgrade) of 5.0 tables.
sql/sql_table.cc:
Allow recreate to open crashed tables.
sql/table.cc:
Fix error message if storage engine doesn't exists.
storage/archive/azio.c:
Reset status values in case archive is of old versions
storage/archive/ha_archive.cc:
Fix to allow one to open old versions of table during repair
Reset status variables for old version tables
If the the table is of old version, force upgrade with ALTER TABLE when doing repair
storage/archive/ha_archive.h:
Added variables to detect old versions
Fall back to use ALTER TABLE for engines that doesn't support REPAIR when doing repair for upgrade.
Nicer output from mysql_upgrade and mysql_check
Updated all arrays that used NAME_LEN to use SAFE_NAME_LEN to ensure that we don't break things accidently as names can now have a #mysql50# prefix.
client/mysql_upgrade.c:
If we are using verbose, also run mysqlcheck in verbose mode.
client/mysqlcheck.c:
Add more information if running in verbose mode
Print 'Needs upgrade' instead of complex error if table needs to be upgraded
Don't write connect information if verbose is not 2 or above
mysql-test/r/drop.result:
Updated test and results as we now support full table names
mysql-test/r/grant.result:
Now you get a correct error message if using #mysql with paths
mysql-test/r/show_check.result:
Update results as table names can temporarly be bigger than NAME_LEN (during upgrade)
mysql-test/r/upgrade.result:
Test upgrade for long table names.
mysql-test/suite/funcs_1/r/is_tables_is.result:
Updated old test result (had note been updated in a while)
mysql-test/t/drop.test:
Updated test and results as we now support full table names
mysql-test/t/grant.test:
Now you get a correct error message if using #mysql with paths
mysql-test/t/upgrade.test:
Test upgrade for long table names.
sql/ha_partition.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/item.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/log_event.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/mysql_priv.h:
Added SAFE_NAME_LEN
sql/rpl_filter.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sp.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sp_head.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_acl.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_base.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_connect.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_parse.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_prepare.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_select.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_show.cc:
NAME_LEN -> SAFE_NAME_LEN
Enlarge table names for SHOW TABLES to also include optional #mysql50#
sql/sql_table.cc:
Fall back to use ALTER TABLE for engines that doesn't support REPAIR when doing repair for upgrade.
sql/sql_trigger.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_udf.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/sql_view.cc:
NAME_LEN -> SAFE_NAME_LEN
sql/table.cc:
Fixed check_table_name() to not count #mysql50# as part of name
If #mysql50# is part of the name, don't allow path characters in name.
sql/item_sum.cc:
Fixed alignment problem that caused crases on sparc. (ORDER needs an aligment of 8 as it includes longlongs)
storage/federatedx/ha_federatedx.cc:
Fixed crash on sparc as 'pos' is not aligned on 4/8.
storage/maria/ma_page.c:
Removed wrong assert
- Changed to still use bcmp() in certain cases becasue
- Faster for short unaligneed strings than memcmp()
- Bettern when using valgrind
- Changed to use my_sprintf() instead of sprintf() to get higher portability for old systems
- Changed code to use MariaDB version of select->skip_record()
- Removed -%::SCCS/s.% from Makefile.am:s to remove automake warnings
The bug was based on wrong undo data in recovery file and not enough checking of bad data.
sql/sql_select.h:
Added comment
storage/maria/ma_blockrec.c:
- Removed wrong sanity checks (didn't work for UNDO records)
- More sanity checks and DBUG_ASSERT
- More DBUG_ENTER and DBUG_PRINT
- Removed filler blocks in extent_to_bitmap_blocks() as it caused problems in write_block_record().
This was the main cause of the bug.
(This change can make records generated by UNDO slightly smaller than original record, which we have to fix
by correcting row_pos.length before calling write_block_record())
- Fixed some problems in write_block_record() while doing UNDO.
- Store header_length without TRANSID_SIZE into recovery log (as UNDO entires doesn't have TRANSID_SIZE)
- Mark table crashed if something goes wrong during UNDO
storage/maria/maria_def.h:
Added header_length
mysql-test/r/group_by.result:
Added test that showed problems that no_rows_in_results() didn't work for expressions
mysql-test/r/subselect4.result:
Test case for LP#612894
mysql-test/t/group_by.test:
Added test that showed problems that no_rows_in_results() didn't work for expressions
mysql-test/t/subselect4.test:
Test case for LP#612894
sql/item.h:
Added restore_to_before_no_rows_in_result()
Added function processor for no_rows_in_results() and restore_to_before_no_rows_in_results() to ensure it works with functions
Fix that above functions are handled by Item_ref()
sql/item_func.h:
Ensure that no_rows_in_results() and restore_to_before_no_rows_in_result() are called for all function arguments
sql/item_sum.cc:
Added restore_to_before_no_rows_in_result() to restore settings after Item_sum_hybrid::no_rows_in_result() was called.
This is needed to handle the case where we have made 'make_const()' on the item in opt_sum(), but the item will be reused again in a sub query.
Ignore multiple calls to no_rows_in_result() as Item_ref is calling it twice.
sql/item_sum.h:
Added restore_to_before_no_rows_in_result();
sql/sql_select.cc:
Added reset of no_rows_in_result() for JOIN::reinit()
sql/sql_select.h:
Added marker if no_rows_in_result() is called.
Fixed LP#613418 (M)aria recovery failure: ma_key_recover.c:981: _ma_apply_redo_index: Assertion `check_page_length == page_length' failed
include/my_sys.h:
Added my_disable_sync
mysql-test/mysql-test-run.pl:
Added --sync-sys=0 to run test suite faster
mysys/my_static.c:
Added my_disable_sync
mysys/my_sync.c:
Added my_disable_sync
sql/mysqld.cc:
Added -sync-sys=0 option for mysqld to skip sync() calls for faster testing
storage/maria/ma_key_recover.c:
More DBUG_ASSERT()
Added logging of KEY_OP_DEBUG to make examening of logs easier
Fixed testing of page length in recovery to ensure we don't overwrite checksum (previous tests was too relaxed)
Fixed bug in recovery logging of split pages which caused failure during recovery:
- Length was not adjusted properly for pages to be split
- Added KEY_OP_MAX_PAGELENGTH to tell recovery that page is now full length
- This fixed LP#613418
storage/maria/ma_key_recover.h:
Changed prototype for ma_log_change() for KEY_OP_DEBUG
storage/maria/ma_loghandler.h:
Added new enums for better debugging of recovery logs
storage/maria/ma_rt_index.c:
Added debugging information to calls to ma_log_change()
storage/maria/ma_write.c:
Added debugging information to calls to ma_log_change() and ma_log_split()
Fixed compiler warnings
client/mysqlslap.c:
Fixed compiler warnings
mysql-test/suite/maria/r/maria.result:
Test case for LP#614265
mysql-test/suite/maria/t/maria.test:
Test case for LP#614265
mysql-test/suite/pbxt/t/skip_name_resolve-master.opt:
Ensure that we get restart before test (as test uses show processlist)
sql/handler.cc:
Added cloned marker if clone was called (for safety checks & debugging)
sql/handler.h:
Added cloned marker if clone was called (for safety checks & debugging)
storage/maria/ha_maria.cc:
In clone call, set file->trn if cloned file had this set. This is needed as maria_create_trn_for_mysql() and thus file->trn is never set for cloned table.
Ensure that file->trn is properly reset after calls to repair/check/zerofill.
Increment locked table count if file->trn is set (as we decrement this in the unlock call)
tests/mysql_client_test.c:
Fixed compiler warnings
Fixed some wrong test cases
Fixed bug in null handling in XtraDB
extra/comp_err.c:
Fixed compiler warnings
extra/my_print_defaults.c:
Fixed compiler warnings
mysql-test/suite/binlog/t/binlog_killed.test:
Added support for timeouts
mysql-test/suite/funcs_1/r/is_columns_is.result:
Updated results (INNODB_SYS_TABLES had got new column)
scripts/mysql_install_db.sh:
Fixed typo
sql/mysql_priv.h:
Removed not needed argument for compare_record()
sql/sql_insert.cc:
Removed not needed argument for compare_record()
sql/sql_update.cc:
Removed not needed argument for compare_record()
The argument is not needed becasue we copy the full record[0] to record[1] and the comparison should work even if all columns are not read
sql/table.cc:
The comparison of rows is independent of HA_PARTIAL_COLUMN_READ
storage/maria/maria_chk.c:
Fixed compiler warnings
storage/maria/maria_read_log.c:
Fixed compiler warnings
storage/myisam/myisamchk.c:
Fixed compiler warnings
storage/myisam/myisampack.c:
Fixed compiler warnings
storage/xtradb/dict/dict0load.c:
Fixed compiler warnings
storage/xtradb/row/row0sel.c:
Fixed null handling in XtraDB. (See comment)
storage/xtradb/trx/trx0sys.c:
Fixed compiler warnings
support-files/compiler_warnings.supp:
Fixed compiler warnings
This was triggered by innodb.innodb_multi_update, where we had a static length row without nulls and xtradb didn't fill in the delete-marker byte
include/my_bitmap.h:
Added prototype for bitmap_union_is_set_all()
mysys/my_bitmap.c:
Added function to check if union of two bit maps covers all bits.
sql/mysql_priv.h:
Updated protype for compare_record()
sql/sql_insert.cc:
Send to compare_record() flag if all fields are used.
sql/sql_select.cc:
Set share->null_bytes_for_compare.
sql/sql_update.cc:
In compare_record() don't use the fast cmp_record() (which is basically memcmp) if we don't know that all fields exists.
Don't compare the null_bytes if there is no data there.
sql/table.cc:
Store in share->null_bytes_for_compare the number of bytes that has null or bit fields (but not delete marker)
Store in can_cmp_whole_record if we can use memcmp() (assuming all rows are read) to compare rows in compare_record()
sql/table.h:
Added two elements in table->share to speed up checking how updated rows can be compared.
Added --strace support to mysql-test-run
mysql-test/mysql-test-run.pl:
Added support for --strace (usefull for example to check how much memory mysqld was using)
mysql-test/suite/funcs_1/t/is_engines_innodb.test:
Fixed test case to also work with xtradb
mysql-test/suite/innodb_plugin/t/innodb.test:
Don't run if we don't have the used character sets.
mysql-test/suite/innodb_plugin/t/innodb_mysql.test:
Don't run if we don't have the used character sets.
sql/sql_show.cc:
Extended comment to 160 characters to get full comment from xtradb
storage/xtradb/handler/ha_innodb.cc:
Fixed valgrind warning.
If one compiles innodb_plugin, then the tests in suite/innodb_plugin will use the plugin. If not and xtradb is used, the tests will use xtradb.
mysql-test/include/have_innodb_plugin.inc:
Test both for innodb_plugin and xtradb
mysql-test/include/have_real_innodb_plugin.inc:
Test if we are using innodb_plugin (but not xtradb)
mysql-test/include/have_xtradb.inc:
Test if xtradb is used
mysql-test/lib/mtr_cases.pm:
Enable easy testing of innodb_plugin
mysql-test/mysql-test-run.pl:
Added supression for difference between xtradb & innodb_plugin
mysql-test/suite/innodb_plugin/r/innodb-index-ip.result:
Tests from innodb-index that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/r/innodb-index-xb.result:
Tests from innodb-index that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/r/innodb-index.result:
Move tests away that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/r/innodb-ip.result:
Tests from innodb-index that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/r/innodb-xb.result:
Tests from innodb-index that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/r/innodb.result:
Move tests away that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/r/innodb_bug21704-xb.result:
Test result differ for xtradb
mysql-test/suite/innodb_plugin/r/innodb_bug46000.result:
Remove (not needed) error message not given by MariaDB
mysql-test/suite/innodb_plugin/r/innodb_bug49164-xb.result:
Test result differs for xtradb
mysql-test/suite/innodb_plugin/r/innodb_bug49164.result:
Update results
mysql-test/suite/innodb_plugin/r/innodb_bug53591.result:
Remove (not needed) error message not given by MariaDB
mysql-test/suite/innodb_plugin/r/innodb_bug54679.result:
Updated result file
mysql-test/suite/innodb_plugin/r/innodb_mysql.result:
Updated result file
mysql-test/suite/innodb_plugin/t/disabled.def:
Disable some tests that depends on newer version of XtraDB
mysql-test/suite/innodb_plugin/t/innodb-index-ip.test:
Tests from innodb-index that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/t/innodb-index-xb.test:
Tests from innodb-index that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/t/innodb-index.test:
Move tests away that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/t/innodb-ip.test:
Tests from innodb-index that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/t/innodb-xb.test:
Tests from innodb-index that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/t/innodb.test:
Move tests away that gave different results for innodb_plugin and xtradb
mysql-test/suite/innodb_plugin/t/innodb_bug21704-xb.test:
Test result differ for xtradb
mysql-test/suite/innodb_plugin/t/innodb_bug21704.test:
Test result differ for xtradb
mysql-test/suite/innodb_plugin/t/innodb_bug53591.test:
Test results only makes sence for innodb_plugin (things works ok for xtradb)
sql/sql_table.cc:
Don't set HA_CREATE_USED_ROW_FORMAT for create table (only for update_create_info) if ROW_FORMAT is not used.
storage/innodb_plugin/handler/ha_innodb.cc:
Fixed wrong error message from innodb.
This is needed as MariaDB properly handles errors from ha_index_init()
storage/xtradb/handler/ha_innodb.cc:
Update base information for XtraDB so that one can use informationschema.plugins to check if one is using XtraDB
A CREATE...SELECT that fails is written to the binary log if a non-transactional
statement is updated. If the logging format is ROW, the CREATE statement and the
changes are written to the binary log as distinct events and by consequence the
created table is not rolled back in the slave.
In this patch, we opted to let the slave goes out of sync by not writting to the
binary log the CREATE statement. We do this by simply reseting the binary log's
cache.
mysql-test/suite/rpl/r/rpl_drop.result:
Added a test case.
mysql-test/suite/rpl/t/rpl_drop.test:
Added a test case.
sql/log.cc:
Introduced a function to clean up the cache.
sql/log.h:
Introduced a function to clean up the cache.
sql/sql_insert.cc:
Cleaned up the binary log cache if a CREATE...SELECT fails.
Speed up some PBXT tests by adding begin...commit around creating of testing tables.
include/my_base.h:
Fixed wrong constant
mysql-test/mysql-test-run.pl:
Print MariaDB instead of MySQL
mysql-test/r/range.result:
Move test that required partitions to parts.optimizer
mysql-test/suite/innodb_plugin/t/disabled.def:
Disable test that causes valgrind warning about not released memory in xtradb
mysql-test/suite/parts/r/optimizer.result:
Moved from range.result
mysql-test/suite/parts/t/optimizer.test:
Moved from range.test
mysql-test/suite/pbxt/r/join_nested.result:
Updated results after optimizer changes
mysql-test/suite/pbxt/r/renamedb.result:
Updated test for new error message
mysql-test/suite/pbxt/t/check.test:
Speed up test
mysql-test/suite/pbxt/t/count_distinct2.test:
Speed up test
mysql-test/suite/pbxt/t/derived.test:
Speed up test
mysql-test/suite/pbxt/t/renamedb.test:
Updated test for new error message
mysql-test/suite/rpl/r/rpl_log_pos.result:
Updated results
mysql-test/suite/rpl/t/rpl_log_pos.test:
Update test to read from a position that has 'known wrong' data.
The orignal test read a timestamp, so the error message could differ between runs.
mysql-test/suite/rpl/t/rpl_temporary_errors.test:
Sync to slave to make test predictable
mysql-test/t/events_time_zone.test:
Extend wait to make test predictable
mysql-test/t/range.test:
Move test that required partitions to parts.optimizer
sql/sql_list.h:
Fixed compiler warning
sql/sql_load.cc:
buffer was not freed in some error conditions
tests/mysql_client_test.c:
Fixed compiler warning
Added 'Aria' as an alias for the Maria storage engine. Real rename is happening in 5.2
sql/handler.cc:
Added 'Aria' as an alias for the Maria storage engine.
Queries may crash, if
1) the GREATEST or the LEAST function has a mixed list of
numeric and LONGBLOB arguments and
2) the result of such a function goes through an intermediate
temporary table.
An Item that references a LONGBLOB field has max_length of
UINT_MAX32 == (2^32 - 1).
The current implementation of GREATEST/LEAST returns REAL
result for a mixed list of numeric and string arguments (that
contradicts with the current documentation, this contradiction
was discussed and it was decided to update the documentation).
The max_length of such a function call was calculated as a
maximum of argument max_length values (i.e. UINT_MAX32).
That max_length value of UINT_MAX32 was used as a length for
the intermediate temporary table Field_double to hold
GREATEST/LEAST function result.
The Field_double::val_str() method call on that field
allocates a String value.
Since an allocation of String reserves an additional byte
for a zero-termination, the size of String buffer was
set to (UINT_MAX32 + 1), that caused an integer overflow:
actually, an empty buffer of size 0 was allocated.
An initialization of the "first" byte of that zero-size
buffer with '\0' caused a crash.
The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.
******
Bug #54461: crash with longblob and union or update with subquery
Queries may crash, if
1) the GREATEST or the LEAST function has a mixed list of
numeric and LONGBLOB arguments and
2) the result of such a function goes through an intermediate
temporary table.
An Item that references a LONGBLOB field has max_length of
UINT_MAX32 == (2^32 - 1).
The current implementation of GREATEST/LEAST returns REAL
result for a mixed list of numeric and string arguments (that
contradicts with the current documentation, this contradiction
was discussed and it was decided to update the documentation).
The max_length of such a function call was calculated as a
maximum of argument max_length values (i.e. UINT_MAX32).
That max_length value of UINT_MAX32 was used as a length for
the intermediate temporary table Field_double to hold
GREATEST/LEAST function result.
The Field_double::val_str() method call on that field
allocates a String value.
Since an allocation of String reserves an additional byte
for a zero-termination, the size of String buffer was
set to (UINT_MAX32 + 1), that caused an integer overflow:
actually, an empty buffer of size 0 was allocated.
An initialization of the "first" byte of that zero-size
buffer with '\0' caused a crash.
The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.
mysql-test/r/func_misc.result:
Test case for bug #54461.
******
Test case for bug #54461.
mysql-test/t/func_misc.test:
Test case for bug #54461.
******
Test case for bug #54461.
sql/item_func.cc:
Bug #54461: crash with longblob and union or update with subquery
The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.
******
Bug #54461: crash with longblob and union or update with subquery
The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.
Fix compiler warnings.
mysys/stacktrace.c:
Tag unused parameters.
sql/sql_lex.cc:
Variable becomes unused in non-debug builds. Also, no need to
assert the obvious.
In order to be able to check if the set of the grouping fields in a
GROUP BY has changed (and thus to start a new group) the optimizer
caches the current values of these fields in a set of Cached_item
derived objects.
The Cached_item_str, used for caching varchar and TEXT columns,
is limited in length by the max_sort_length variable.
A String buffer to store the value with an alloced length of either
the max length of the string or the value of max_sort_length
(whichever is smaller) in Cached_item_str's constructor.
Then, at compare time the value of the string to compare to was
truncated to the alloced length of the string buffer inside
Cached_item_str.
This is all fine and valid, but only if you're not assigning
values near or equal to the alloced length of this buffer.
Because when assigning values like this the alloced length is
rounded up and as a result the next set of data will not match the
group buffer, thus leading to wrong results because of the changed
alloced_length.
Fixed by preserving the original maximum length in the
Cached_item_str's constructor and using this instead of the
alloced_length to limit the string to compare to.
Test case added.
Fix a regression (due to a typo) which caused spurious incorrect
argument errors for long data stream parameters if all forms of
logging were disabled (binary, general and slow logs).
mysql-test/t/mysql_client_test.test:
Save the status of the slow_log.
sql/sql_prepare.cc:
Add a missing logical NOT operator.
tests/mysql_client_test.c:
Disable all query logs when running C tests. Fixes a omission
when, slow log should have been disabled too.
Run test case for Bug#54041 with query logs enabled and disabled.
With statement- or mixed-mode logging, "LOAD DATA INFILE" queries
are written to the binlog using special types of log events.
When mysqlbinlog reads such events, it re-creates the file in a
temporary directory with a generated filename and outputs a
"LOAD DATA INFILE" query where the filename is replaced by the
generated file. The temporary file is not deleted by mysqlbinlog
after termination.
To fix the problem, in mixed mode we go to row-based. In SBR, we
document it to remind user the tmpfile is left in a temporary
directory.
mysql-test/suite/binlog/r/binlog_mixed_load_data.result:
Test result for BUG#34283.
mysql-test/suite/binlog/t/binlog_mixed_load_data.test:
Added the test file to verify that 'load data infile...' statement
will go to row-based in mixed mode.
sql/sql_load.cc:
Added code to go to row-based in mixed mode for
'load data infile ...' statement
/*![:version:] Query Code */, where [:version:] is a sequence of 5
digits representing the mysql server version(e.g /*!50200 ... */),
is a special comment that the query in it can be executed on those
servers whose versions are larger than the version appearing in the
comment. It leads to a security issue when slave's version is larger
than master's. A malicious user can improve his privileges on slaves.
Because slave SQL thread is running with SUPER privileges, so it can
execute queries that he/she does not have privileges on master.
This bug is fixed with the logic below:
- To replace '!' with ' ' in the magic comments which are not applied on
master. So they become common comments and will not be applied on slave.
- Example:
'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
will be binlogged as
'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/
mysql-test/suite/rpl/t/rpl_conditional_comments.test:
Test the patch for this bug.
sql/mysql_priv.h:
Rename inBuf as rawBuf and remove the const limitation.
sql/sql_lex.cc:
To replace '!' with ' ' in the magic comments which are not applied on
master.
sql/sql_lex.h:
Remove the const limitation on parameter buff, as it can be modified in the function since
this patch.
Add member function yyUnput for Lex_input_stream. It set a character back the query buff.
sql/sql_parse.cc:
Rename inBuf as rawBuf and remove the const limitation.
sql/sql_partition.cc:
Remove the const limitation on parameter part_buff, as it can be modified in the function since
this patch.
sql/sql_partition.h:
Remove the const limitation on parameter part_buff, as it can be modified in the function since
this patch.
sql/table.h:
Remove the const limitation on variable partition_info, as it can be modified since
this patch.
prepared statements
Using GROUP_CONCAT() together with the WITH ROLLUP modifier
could crash the server.
The reason was a combination of several facts:
1. The Item_func_group_concat class stores pointers to ORDER
objects representing the columns in the ORDER BY clause of
GROUP_CONCAT().
2. find_order_in_list() called from
Item_func_group_concat::setup() modifies the ORDER objects so
that their 'item' member points to the arguments list
allocated in the Item_func_group_concat constructor.
3. In some cases (e.g. in JOIN::rollup_make_fields) a copy of
the original Item_func_group_concat object could be created by
using the Item_func_group_concat::Item_func_group_concat(THD
*thd, Item_func_group_concat *item) copy constructor. The
latter essentially creates a shallow copy of the source
object. Memory for the arguments array is allocated on
thd->mem_root, but the pointers for arguments and ORDER are
copied verbatim.
What happens in the test case is that when executing the query
for the first time, after a copy of the original
Item_func_group_concat object has been created by
JOIN::rollup_make_fields(), find_order_in_list() is called for
this new object. It then resolves ORDER BY by modifying the
ORDER objects so that they point to elements of the arguments
array which is local to the cloned object. When thd->mem_root
is freed upon completing the execution, pointers in the ORDER
objects become invalid. Those ORDER objects, however, are also
shared with the original Item_func_group_concat object which is
preserved between executions of a prepared statement. So the
first call to find_order_in_list() for the original object on
the second execution tries to dereference an invalid pointer.
The solution is to create copies of the ORDER objects when
copying Item_func_group_concat to not leave any stale pointers
in other instances with different lifecycles.
mysql-test/r/func_gconcat.result:
Test case for bug #54476.
mysql-test/t/func_gconcat.test:
Test case for bug #54476.
sql/item_sum.cc:
Copy the ORDER objects pointed to by the elements of the
'order' array in the copy constructor of
Item_func_group_concat.
sql/table.h:
Removed the unused 'item_copy' member of the ORDER class.
SHOW DATABASES LIKE ... was not converting to lowercase on comparison as the
documentation is suggesting.
Fixed it to behave similarly to SHOW TABLES LIKE ... and updated the failing
on MacOSX lowercase_table2 test case.
