Commit graph

3273 commits

Author SHA1 Message Date
Alexander Barkov
46dee0d184 MDEV-10717 Assertion `!null_value' failed in virtual bool Item::send(Protocol*, String*)
The problem was that null_value was not set to "false" on a well-formed row.
If an ill-formed row was followed by a well-forned row, null_value remained
"true" in the call of Item::send() for the well-formed row.
2016-12-06 06:54:52 +04:00
Sergei Golubchik
7ae555c114 Merge branch 'mysql/5.5' into 5.5
80% reverted
2016-09-11 20:51:09 +02:00
Oleksandr Byelkin
b9631e310b MDEV-8833 Crash of server on prepared statement with conversion to semi-join
Correct context chain made to allow outer fields pullout.
2016-09-02 18:34:37 +02:00
Sreeharsha Ramanavarapu
ac460e584d Bug #23280699: MYSQLD GOT SIGNAL 11 IN IS_NULL ON SELECT
FROM I_S

Issue:
------
There is a difference in the field type created when the
following DDLs are used:

1) CREATE TABLE t0 AS SELECT NULL;
2) CREATE TABLE t0 AS SELECT GREATEST(NULL,NULL);

The first statement creates field of type Field_string and
the second one creates a field of type Field_null.

This creates a problem when the query mentioned in this bug
is used. Since the null_ptr is calculated differently for
Field_null.

Solution:
---------
When there is a function returning null in the select list
as mentioned above, the field should be of type
Field_string.

This was fixed in 5.6+ as part of Bug#14021323. This is a
backport to mysql-5.5.

An incorrect comment in innodb_bug54044.test has been
corrected in all versions.
2016-07-22 07:33:43 +05:30
Sergei Golubchik
ae29ea2d86 Merge branch 'mysql/5.5' into 5.5 2016-06-14 13:55:28 +02:00
Sreeharsha Ramanavarapu
115f08284d Bug #23279858: MYSQLD GOT SIGNAL 11 ON SIMPLE SELECT
NAME_CONST QUERY

ISSUE:
------
Using NAME_CONST with a non-constant negated expression as
value can result in incorrect behavior.

SOLUTION:
---------
The problem can be avoided by checking whether the argument
is a constant value.

The fix is a backport of Bug#12735545.
2016-05-24 07:44:21 +05:30
Sergei Golubchik
b069d19284 Merge branch 'mysql/5.5' into 5.5 2016-04-20 15:25:55 +02:00
Sreeharsha Ramanavarapu
767bab4abe Bug #18740222: CRASH IN GET_INTERVAL_INFO WITH WEIRDO
INTERVALS

ISSUE:
------
Some string functions return one or a combination of the
parameters as their result. Here the resultant string's
charset could be incorrectly set to that of the chosen
parameter.

This results in incorrect behavior when an ascii string is
expected.

SOLUTION:
---------
Since an ascii string is expected, val_str_ascii should
explicitly convert the string.

Part of the fix is a backport of Bug#22340858 for mysql-5.5
and mysql-5.6.
2016-03-03 06:42:12 +05:30
Sergei Golubchik
f3444df415 Merge branch 'mysql/5.5' into 5.5
reverted about half of commits as either not applicable or
outright wrong
2016-02-09 11:27:40 +01:00
Sreeharsha Ramanavarapu
718c787912 Bug #18823979: PS: UCS2 + CASE WHEN THEN ELSE CRASH IN
ITEM_PARAM::SAFE_CHARSET_CONVERTER

ISSUE:
------
Charset conversion on a null parameter is not handled
correctly.

SOLUTION:
---------
Item_param's charset converter does not handle the case
where it might have to deal with a null value. This is
fine for other charset converters since the value is not
supplied to them at runtime.

The fix is to check if the parameter is now set to null and
return an Item_null object. Also, there is no need to
initialize Item_param's cnvitem in the constructor to a
string. This can be done in
ITEM_PARAM::SAFE_CHARSET_CONVERTER itself.

Members of Item_param, cnvbuf and cnvstr, have been removed
and cnvitem has been made a local variable in
ITEM_PARAM::SAFE_CHARSET_CONVERTER.
2016-01-29 08:29:06 +05:30
Knut Anders Hatlen
95825fa28a Bug#21682356: STOP INJECTING DATA ITEMS IN AN ERROR MESSAGE
GENERATED BY THE EXP() FUNCTION

When generating the error message for numeric overflow, pass a flag to
Item::print() that prevents it from expanding constant expressions and
parameters to the values they evaluate to.

For consistency, also pass the flag to Item::print() when
Item_func_spatial_collection::fix_length_and_dec() generates an error
message. It doesn't make any difference at the moment, since constant
expressions haven't been evaluated yet when this function is called.
2016-01-17 20:28:00 +01:00
Oleksandr Byelkin
13ad179c96 MDEV-8756 MariaDB 10.0.21 crashes during PREPARE
Non-select-like queries has no correct JOIN structure connected to top-most SELECT_LEX (and should not).
2015-11-20 14:50:18 +01:00
Chaithra Gopalareddy
a7fb5aecfd Bug#19941403: FATAL_SIGNAL(SIG 6) IN BUILD_EQUAL_ITEMS_FOR_COND | IN SQL/SQL_OPTIMIZER.CC:1657
Problem:
At the end of first execution select_lex->prep_where is pointing to
a runtime created object (temporary table field). As a result
server exits trying to access a invalid pointer during second
execution.

Analysis:
While optimizing the join conditions for the query, after the
permanent transformation, optimizer makes a copy of the new
where conditions in select_lex->prep_where. "prep_where" is what
is used as the "where condition" for the query at the start of execution.
W.r.t the query in question, "where" condition is actually pointing
to a field in the temporary table. As a result, for the  second
execution the pointer is no more valid resulting in server exit.

Fix:
At the end of the first execution, select_lex->where will have the
original item of the where condition.
Make prep_where the new place where the original item of select->where
has to be rolled back.
Fixed in 5.7 with the wl#7082 - Move permanent transformations from
JOIN::optimize to JOIN::prepare

Patch for 5.5 includes the following backports from 5.6:

Bugfix for Bug12603141 - This makes the first execute statement in the testcase
pass in 5.5

However it was noted later in in Bug16163596 that the above bugfix needed to
be modified. Although Bug16163596 is reproducible only with changes done for
Bug12582849, we have decided include the fix.

Considering that Bug12582849 is related to Bug12603141, the fix is
also included here. However this results in Bug16317817, Bug16317685,
Bug16739050. So fix for the above three bugs is also part of this patch.
2015-11-20 12:30:15 +05:30
Oleksandr Byelkin
7e4da9b370 DEV-8632 Segmentation fault on INSERT
View/derived fields should be taken into account when we build ref_pointer_array constructed.

DBUG_ASSERTs added to avoid memory overrun.
2015-11-09 16:08:06 +01:00
Sergei Golubchik
4d5772c578 MDEV-7810 Wrong result on execution of a query as a PS (both 1st and further executions)
Alternative fix that doesn't cause view.test crash in --ps:
Remember when Item_ref was fixed right in the constructor
and did not have a full Item_ref::fix_fields() call. Later
in PS/SP, after Item_ref::cleanup, we use this knowledge
to avoid doing full fix_fields() for items that were never
supposed to be fix_field'ed.

Simplify the test case.
2015-07-31 17:17:33 +02:00
Sreeharsha Ramanavarapu
c773b320ff Merge branch 'mysql-5.1' into mysql-5.5 2015-07-10 07:54:55 +05:30
Sreeharsha Ramanavarapu
33a2e5abd8 Bug #20238729: ILLEGALLY CRAFTED UTF8 SELECT PROVIDES NO
WARNINGS

Backporting to 5.1 and 5.5
2015-07-10 07:52:00 +05:30
Monty
67c56ab1e4 Simple cleanups
- Removing use of calls to current_thd
- More DBUG_PRINT
- Code style changes
- Made some local functions static
Ensure that calls to print_keyuse are locked with mutex to get all lines in same debug packet
2015-06-25 23:34:54 +03:00
Monty
2e941fe9fc Fixed crashing bug when using ONLY_FULL_GROUP_BY in a stored procedure/trigger that is repeatedly executed.
This is MDEV-7601, including it's sub tasks MDEV-7594, MDEV-7555, MDEV-7590, MDEV-7581, MDEV-7589

The problem was that select_lex->non_agg_fields was not properly reset for re-execution and this caused an overwrite of a random memory position.
The fix was move non_agg_fields from select_lext to JOIN, which is properly reset.
2015-06-25 23:18:48 +03:00
Sergei Golubchik
b96c196f1c Item_cache::safe_charset_converter() fixes
* take into account that example may be NULL
* use example->safe_charset_converter(), copy-paste from
  Item::safe_charset_converter() (example might have its own
  implementation)
* handle the case when the charset doesn't need conversion
  (and return this).
2015-06-11 16:48:10 +02:00
Alexander Barkov
a765cca69f MDEV-8067 correct fix for MySQL Bug # 19699237: UNINITIALIZED VARIABLE IN ITEM_FIELD::STR_RESULT 2015-06-08 20:50:40 +04:00
Alexey Botchkov
b37b52a3a2 MDEV-4922 Stored Procedure - Geometry parameter not working.
Fhe GEOMETRY field should be handled just as the BLOB field. So that was fiexed in field_conv.
  One additional bug was found and fixed meanwhile - thet the geometry field subtypes
  should also be merged for UNION command.
2015-06-08 13:47:07 +05:00
Oleksandr Byelkin
5fd0088356 MDEV-8058: funcs_1.innodb_views and funcs_1.memory_views fail
The double call of ref used tables fixed.
2015-04-27 15:31:56 +02:00
Oleksandr Byelkin
20109712ae MDEV-6892: WHERE does not apply
Taking into account implicit dependence of constant view field from nullable table of left join added.

Fixed finding real table to check if it turned to NULL (materialized view & derived taken into account)

Removed incorrect uninitialization.
2015-04-23 15:56:10 +02:00
unknown
a4ff2afcb4 cleanup 2014-12-17 14:38:14 +01:00
unknown
ff5349bd6c MDEV-6985: MariaDB crashes on stored procedure call
Item_ident fixed to allow double cleanup().
2014-12-17 14:35:13 +01:00
Sergei Golubchik
1ddfce4840 mysql-5.5.40 2014-10-06 19:53:55 +02:00
Alexander Barkov
68354ef272 MDEV-6592 Assertion `ltime->day == 0' failed with TIMESTAMP, MAKETIME 2014-10-03 15:07:53 +04:00
Tor Didriksen
ab727cec04 Bug#18928848 II. MALLOC OF UNINITIALIZED MEMORY SIZE
Several string functions have optimizations for constant
sub-expressions which lead to setting max_length == 0.

For subqueries, where we need a temporary table to holde the result,
we need to ensure that we use a VARCHAR(0) column rather than a
CHAR(0) column when such expressions take part in grouping.
With CHAR(0) end_update() may write garbage into the next field.
2014-08-21 16:42:04 +02:00
Tor Didriksen
63a6af3285 Bug#18928848 II. MALLOC OF UNINITIALIZED MEMORY SIZE
Several string functions have optimizations for constant
sub-expressions which lead to setting max_length == 0.

For subqueries, where we need a temporary table to holde the result,
we need to ensure that we use a VARCHAR(0) column rather than a
CHAR(0) column when such expressions take part in grouping.
With CHAR(0) end_update() may write garbage into the next field.
2014-08-21 16:42:04 +02:00
Alexander Barkov
c57c5be12a MDEV-5745 analyze MySQL fix for bug#12368495 2014-07-28 12:47:14 +04:00
Tor Didriksen
dbed459a6f Bug#18935421 RPAD DIES WITH CERTAIN PADSTR INTPUTS....
For rpad() and lpad(): verify that the padding string is well-formed.
2014-07-07 12:05:30 +02:00
Tor Didriksen
4e62c18904 Bug#18935421 RPAD DIES WITH CERTAIN PADSTR INTPUTS....
For rpad() and lpad(): verify that the padding string is well-formed.
2014-07-07 12:05:30 +02:00
Alexander Barkov
284479c085 Merge 5.3->5.5 2014-06-04 21:53:15 +04:00
Alexander Barkov
661daf16f1 MDEV-4858 Wrong results for a huge unsigned value inserted into a TIME column
MDEV-6099 Bad results for DATE_ADD(.., INTERVAL 2000000000000000000.0 SECOND)
MDEV-6097 Inconsistent results for CAST(int,decimal,double AS DATETIME)
MDEV-6100 No warning on CAST(9000000 AS TIME)
2014-06-04 20:32:57 +04:00
unknown
3f80740aa8 merge 5.5->5.3 2014-05-07 09:28:12 +03:00
unknown
285160dee2 MDEV-5981: name resolution issues with views and multi-update in ps-protocol
It is triple bug with one test suite:
1. Incorrect outer table detection
2. Incorrect leaf table processing for multi-update (should be full like for usual updates and inserts)
3. ON condition fix_fields() fould be called for all tables of the query.
2014-05-01 17:19:17 +03:00
Sergei Golubchik
5d0c01608c 5.2 merge 2014-03-16 21:03:01 +01:00
Sergei Golubchik
e772cbd7b7 5.1 merge 2014-03-16 13:59:44 +01:00
Sergei Golubchik
d7304375e5 mysql-5.1.73 merge 2014-03-15 18:24:15 +01:00
unknown
5c8ed7dd54 MDEV-5446: Assertion `!table || (!table->read_set || bitmap_is_set(table->read_set, field_index))' fails on EXPLAIN EXTENDED with VALUES function
field_index should be set correctly for null field created by Item_insert_value::fix_fields().
2014-03-14 11:38:17 +02:00
Michael Widenius
b17a053cc9 MDEV-6129: Server crashes during UNION with ORDER BY field IS NULL
Fixed crashing bug for union queries where there was no real tables.


mysql-test/r/group_by.result:
  Added test case
mysql-test/t/group_by.test:
  Added test case
sql/db.opt:
  Removed genrated file
sql/item.cc:
  Handled case when table_list->pos_in_tables is not set. Can only happens when there is no real tables in query
2014-04-24 18:20:57 +03:00
Sergei Golubchik
5d8c15228e 5.3-merge 2014-03-16 19:21:37 +01:00
Sergei Golubchik
913beda8c8 5.2 merge 2014-02-13 10:15:03 +01:00
Sergei Golubchik
fb27ce22f7 5.3 merge 2014-02-14 14:09:29 +01:00
Sergei Golubchik
48445f3556 5.1 merge 2014-02-13 08:25:33 +01:00
Sergei Golubchik
52f038c5c3 MDEV-5655 Server crashes on NAME_CONST containing AND/OR expressions
fix the NAME_CONST check to only allow literals, negated literals, and literals with
the explicit collation.
2014-02-12 21:17:28 +01:00
Michael Widenius
1bdf2151da Fixed MDEV-5617: mysqld crashes when running a query with ONLY_FULL_GROUP_BY
Problem was that we used cache_table in some cases where it was not initialized

mysql-test/r/func_group.result:
  Added test case
mysql-test/t/func_group.test:
  Added test case
sql/item.cc:
  Don't use cached_table if not set
sql/item_sum.cc:
  Don't use cached_table
2014-02-11 16:58:49 +02:00
Michael Widenius
d15b3386db Fix for MDEV-5531: double call procedure in one session - hard shutdown the server
Main fix was to not cache derivied tables as they may be temporary tables that are deleted before the next query.
This was a bit tricky as Item_field::fix_fields depended on cached_tables to be set to resolve some columns.



mysql-test/r/sp-bugs.result:
  Added test case
mysql-test/t/sp-bugs.test:
  Added test case
sql/item.cc:
  Fixed fix_outer_field to handle case where found field did not have in cached_table
  Idea is that if cached_table is not avaliable, use from_field->table->pos_in_table_list instead
sql/records.cc:
  Also accept INTERNAL_TMP_TABLE for memmap
sql/sql_base.cc:
  More DBUG_PRINT
  Fixed that setup_natural_join_row_types() is not run twice.
  Original code modified context->first_name_resolution_table also for second executions.
  This was wrong as this could give wrong results if some joins had been optimized away between calls.
sql/sql_derived.cc:
  Mark derived tables as internal temporary tables (INTERNAL_TMP_TABLE), not as NON_TRANSACTIONAL_TMP_TABLE.
  This is more correct as the tables are not visible by the end user.
sql/sql_insert.cc:
  Reset pos_in_table_list before calling fix_fields.
  One of the consequences of the change of not caching all generated tables in Item_ident is that
  pos_in_table_list needs to be correct in calls to fix_fields.
sql/sql_lex.cc:
  More DBUG_PRINT
sql/sql_parse.cc:
  Don't cache derivied tables as they may be temporary tables that are deleted before the next query
sql/sql_select.cc:
  Reset table_vector. This was required as some code checked the vector to see if temporary tables had already been created.
sql/table.cc:
  Mark tables with field translations as cacheable (as these will not disapper between stmt executions.
2014-01-24 14:50:18 +02:00
Alexander Barkov
2394fa67d4 MDEV-4859 Wrong value and data type of "SELECT MAX(time_column) + 1 FROM t1"
Fixed.
2013-11-21 11:46:36 +04:00