Commit graph

64306 commits

Author SHA1 Message Date
Georgi Kodinov
59e0eb1e2c empty weave merge mysql-5.0-security->mysql-5.1-security 2012-03-21 14:58:27 +02:00
Georgi Kodinov
262c156849 merge mysql-5.1->mysql-5.1-security 2012-03-21 14:53:09 +02:00
Georgi Kodinov
65a94c3aa3 weave merge mysql-5.0->mysql-5.0-security 2012-03-21 14:35:25 +02:00
Joerg Bruehe
8a1a4cbd7c Upmerge an empty merge changeset (backmerge of 5.0.96 into main 5.0),
solve a conflict in ".bzr-mysql/default.conf".
2012-03-21 11:18:21 +01:00
karen.langford@oracle.com
3adb401c8a Merge from mysql-5.1.62-release 2012-03-20 17:35:41 +01:00
karen.langford@oracle.com
e990b8dac5 Merge from mysql-5.0.96-release 2012-03-20 17:30:49 +01:00
Annamalai Gurusami
d4ed7cf411 Bug #11766634 59783: INNODB DATA GROWS UNEXPECTEDLY WHEN INSERTING, TRUNCATING, INSERTING THE
The test case must insert all the records using a single transaction. Otherwise the test 
case takes more than 15 minutes and will time out in pb2 and mtr.
2012-03-16 12:06:29 +05:30
Inaam Rana
486e5e5ae3 Bug#13825266 RACE IN LOCK_VALIDATE() WHEN ACCESSING PAGES DIRECTLY
FROM BUFFER POOL

rb://975
approved by: Marko Makela

There is a race in lock_validate() where we try to access a page
without ensuring that the tablespace stays valid during the operation
i.e.: it is not deleted. This patch tries to fix that by using an
existing flag (the flag is renamed to make it's name more generic
in line with it's new use).
2012-03-15 13:30:17 -04:00
Inaam Rana
8729b2e584 Bug#13851171 STRING OVERFLOW IN INNODB CODE FOUND BY STATIC ANALYSIS
rb://976
approved by: Marko Makela

Add an assertion to ensure that string overflow is not happening.
Pointed by Coverity analysis.
2012-03-15 12:38:40 -04:00
Inaam Rana
df2da7d7cc Bug#13537504 VALGRIND: COND. JUMP/MOVE DEPENDS ON UNINITIALISED VALUES
IN OS_THREAD_EQ

rb://977
approved by: Marko Makela

rw_lock::writer_thread field contains the thread id of current x-holder
or wait-x thread. This field is un-initialized at lock creation and is
written to for the first time when an attempt is made to x-lock.

Current code considers ::writer_thread as valid memory region only when
the lock is held in x-mode (or there is an x-waiter). This is an
overkill and it generates valgrind warnings.

The fix is to consider ::writer_thread as valid memory region once it
has been written to.

Reasoning:
==========
The ::writer_thread can be safely considered valid because:

* We only ever do comparison with current calling threads id.
* We only ever do comparison when ::recursive flag is set
* We always unset ::recursive flag in x-unlock
* Same thread cannot be unlocking and attempting to lock at the same
time
* thread_id recycling is not an issue because before an id is recycled
the thread must leave innodb meaning it must release all locks meaning
it must unset ::recursive flag.
2012-03-15 11:53:30 -04:00
Luis Soares
975e67083d BUG#12400313
Adding missing sync_slave_with_master to the test case.
2012-03-12 23:23:40 +00:00
Luis Soares
deb49a2683 Automerge merge with latest mysql-5.1. 2012-03-12 23:16:44 +00:00
Luis Soares
ab03c5bace BUG#12400313
Hardening the test case:
  - including a diff_tables at the end.
  - increasing the tolerance on the relay limit size.
2012-03-12 23:15:01 +00:00
Luis Soares
c41a6fec10 BUG#12400313
Automerge with mysql-5.1.
2012-03-12 21:58:00 +00:00
Luis Soares
5360c4e5bc BUG#12400313 RELAY_LOG_SPACE_LIMIT IS NOT WORKING IN MANY CASES
BUG#64503: mysql frequently ignores --relay-log-space-limit

When the SQL thread goes to sleep, waiting for more events, it sets
the flag ignore_log_space_limit to true. This gives the IO thread a
chance to queue some more events and ultimately the SQL thread will be
able to purge the log once it is rotated. By then the SQL thread
resets the ignore_log_space_limit to false. However, between the time
the SQL thread has set the ignore flag and the time it resets it, the
IO thread will be queuing events in the relay log, possibly going way
over the limit.

This patch makes the IO and SQL thread to synchronize when they reach
the space limit and only ask for one event at a time. Thus the SQL
thread sets ignore_log_space_limit flag and the IO thread resets it to
false everytime it processes one more event. In addition, everytime
the SQL thread processes the next event, and the limit has been
reached, it checks if the IO thread should rotate. If it should, it
instructs the IO thread to rotate, giving the SQL thread a chance to
purge the logs (freeing space). Finally, this patch removes the
resetting of the ignore_log_space_limit flag from purge_first_log,
because this is now reset by the IO thread every time it processes the
next event when the limit has been reached.

If the SQL thread is in a transaction, it cannot purge so, there is no
point in asking the IO thread to rotate. The only thing it can do is
to ask for more events until the transaction is over (then it can ask
the IO to rotate and purge the log right away). Otherwise, there would
be a deadlock (SQL would not be able to purge and IO thread would not
be able to queue events so that the SQL would finish the transaction).
2012-03-12 12:28:27 +00:00
Norvald H. Ryeng
2e72df370b Bug#13031606 VALUES() IN A SELECT STATEMENT CRASHES SERVER
Problem: Grouping results by VALUES(alias for string literal) causes
the server to crash.

Item_insert_values is not constructed to handle other types of
arguments than field and reference to field. In this case, the
argument is an Item_string, and this causes
Item_insert_values::fix_fields() to crash.

Fix: Issue an error message when the argument to Item_insert_values is
not a field or a reference to a field.

This is slightly in breach with documentation, which states that
VALUES should return NULL, but the error message is only issued in
cases where the server otherwise would crash, so there is no change in
behavior for queries that already work. Future versions will restrict
syntax so that using VALUES in this way is illegal.
2012-03-12 08:56:56 +01:00
Dmitry Lenev
745b849455 Fixed test case for bug #13105873 "valgrind warning:possible
crash in foreign key handling on subsequent create table if
not exists".

Do not leave current database unassigned after the end of
the test case.
2012-03-11 16:05:42 +04:00
Annamalai Gurusami
da4418977d Bug #11766634 59783: InnoDB data grows unexpectedly when inserting,
truncating, inserting the same set of rows. When a table is 
re-created with the same set of rows, the data file size must
not grow.  

rb:968
Approved by Marko.
2012-03-09 11:07:16 +05:30
Georgi Kodinov
bd0991b105 empty weave merge mysql-5.0-security->mysql-5.1-security 2012-03-08 17:20:03 +02:00
Georgi Kodinov
8232d9a6ee merge mysql-5.1->mysql-5.1-security 2012-03-08 17:16:53 +02:00
Georgi Kodinov
bd21f317e9 empty auto merge of mysql-5.0->mysql-5.0-security 2012-03-08 17:15:43 +02:00
Marko Mäkelä
abadbe79a4 Fix a compiler warning about possibly uninitiaizlied variable. 2012-03-08 17:10:10 +02:00
Marko Mäkelä
76e064e209 Bug#13807811 BTR_PCUR_RESTORE_POSITION() CAN SKIP A RECORD
This bug has been there at least since MySQL 4.0.9. (Before 4.0.9, the
code probably was even more severely broken.)

btr_pcur_restore_position(): When cursor restoration fails, before
invoking btr_pcur_store_position() move to the previous or next record
unless cursor->rel_pos==BTR_PCUR_ON or the record was not a user
record.

This bug can cause skipped records when btr_pcur_store_position() is
called on the last record of a page. A symptom would be record count
mismatch in CHECK TABLE, or failure to find a record to delete-mark or
update or purge. The following operations should be affected by the
bug:

* row_search_for_mysql(): SELECT, UPDATE, REPLACE, CHECK TABLE,
  (almost anything else than INSERT)

* foreign key CASCADE operations

* row_merge_read_clustered_index(): index creation (since MySQL 5.1
  InnoDB Plugin)

* multi-threaded purge (after MySQL 5.5): not sure, but it might fail
  to purge some records

Not all callers of btr_pcur_restore_position() should be affected.
Anything that asserts or checks that restoration succeeds is
unaffected. For example, cursor restoration on the change buffer tree
should always succeed, because access is being protected by additional
latches. Likewise, rollback, or any code accesses data dictionary
tables while holding dict_sys->mutex should be safe.

rb:967 approved by Jimmy Yang
2012-03-08 14:56:22 +02:00
Tor Didriksen
268bf557a9 Bug#11761576 54082: HANDLE_SEGFAULT MAKES USE OF UNSAFE FUNCTIONS
Post-push fixes.
2012-03-06 13:30:30 +01:00
Ramil Kalimullin
930a5b918d BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN
GEOMETRY FUNCTION ARGUMENTS

Fixed --ps-protocol gis test failure.
2012-03-06 15:13:56 +04:00
Ramil Kalimullin
97c429f65b BUG#12537203 - CRASH WHEN SUBSELECTING GLOBAL VARIABLES IN GEOMETRY FUNCTION ARGUMENTS
A defect in the subquery substitution code may lead to a server crash:
setting substitution's name should be followed by setting its length
(to keep them in sync).
2012-03-05 22:15:23 +04:00
Ramil Kalimullin
44d88da575 Fix for BUG#12414917 - ISCLOSED() CRASHES ON 64-BIT BUILDS
Problem:      
lack of incoming geometry data validation may 
lead to a server crash when ISCLOSED() function called.

Solution:
necessary incoming data check added.
2012-03-05 21:58:07 +04:00
Joerg Bruehe
3aa13d8ca1 Upmerge the yaSSL upgrade (to 2.2.0) from MySQL 5.0 to 5.1. 2012-03-02 13:18:12 +01:00
Joerg Bruehe
01dca16d61 Further upgrade the yaSSL library to version 2.2.0
to pick up some new security fixes that are in it.

Patch provided by Georgi Kodinov.
2012-03-02 13:12:07 +01:00
Annamalai Gurusami
98642459db The innodb plugin module cannot use DEBUG_SYNC_C facility on Windows.
Taking care of it.
2012-03-01 15:44:23 +05:30
Annamalai Gurusami
27ecea534c Bug#13635833: MULTIPLE CRASHES IN FOREIGN KEY CODE WITH CONCURRENT DDL/DML
There are two threads.  In one thread, dml operation is going on 
involving cascaded update operation.  In another thread, alter 
table add foreign key constraint is happening.  Under these 
circumstances, it is possible for the dml thread to access a 
dict_foreign_t object that has been freed by the ddl thread.  
The debug sync test case provides the sequence of operations.  
Without fix, the test case will crash the server (because of 
newly added assert).  With fix, the alter table stmt will return 
an error message.  
      
Backporting the fix from MySQL 5.5 to 5.1

rb:961
rb:947
2012-03-01 11:05:51 +05:30
Mattias Jonsson
bd5f062f92 merge into mysql-5.1 2012-02-29 20:51:38 +01:00
Praveenkumar Hulakund
892760d9ee Bug#12601974 - STORED PROCEDURE SQL_MODE=NO_BACKSLASH_ESCAPES IGNORED AND BREAKS REPLICATION
Analysis:
========================
sql_mode "NO_BACKSLASH_ESCAPES": When user want to use backslash as character input,
instead of escape character in a string literal then sql_mode can be set to 
"NO_BACKSLASH_ESCAPES". With this mode enabled, backslash becomes an ordinary 
character like any other. 

SQL_MODE set applies to the current client session. And while creating the stored 
procedure, MySQL stores the current sql_mode and always executes the stored 
procedure in sql_mode stored with the Procedure, regardless of the server SQL 
mode in effect when the routine is invoked.  

In the scenario (for which bug is reported), the routine is created with 
sql_mode=NO_BACKSLASH_ESCAPES. And routine is executed with the invoker sql_mode
is "" (NOT SET) by executing statement "call testp('Axel\'s')".
Since invoker sql_mode is "" (NOT_SET), the '\' in 'Axel\'s'(argument to function)
is considered as escape character and column "a" (of table "t1") values are 
updated with "Axel's". The binary log generated for above update operation is as below,

  set sql_mode=XXXXXX (for no_backslash_escapes)
  update test.t1 set a= NAME_CONST('var',_latin1'Axel\'s' COLLATE 'latin1_swedish_ci');

While logging stored procedure statements, the local variables (params) used in
statements are replaced with the NAME_CONST(var_name, var_value) (Internal function) 
(http://dev.mysql.com/doc/refman/5.6/en/miscellaneous-functions.html#function_name-const)

On slave, these logs are applied. NAME_CONST is parsed to get the variable and its
value. Since, stored procedure is created with sql_mode="NO_BACKSLASH_ESCAPES", the sql_mode
is also logged in. So that at slave this sql_mode is set before executing the statements
of routine.  So at slave, sql_mode is set to "NO_BACKSLASH_ESCAPES" and then while
parsing NAME_CONST of string variable, '\' is considered as NON ESCAPE character
and parsing reported error for "'" (as we have only one "'" no backslash). 

At slave, parsing was proper with sql_mode "NO_BACKSLASH_ESCAPES".
But above error reported while writing bin log, "'" (of Axel's) is escaped with
"\" character. Actually, all special characters (n, r, ', ", \, 0...) are escaped
while writing NAME_CONST for string variable(param, local variable) in bin log 
irrespective of "NO_BACKSLASH_ESCAPES" sql_mode. So, basically, the problem is 
that logging string parameter does not take into account sql_mode value.

Fix:
========================
So when sql_mode is set to "NO_BACKSLASH_ESCAPES", escaping  characters as 
(n, r, ', ", \, 0...) should be avoided. To do so, added a check to not to
escape such characters while writing NAME_CONST for string variables in bin 
log. 
And when sql_mode is set to NO_BACKSLASH_ESCAPES, quote character "'" is
represented as ''.
http://dev.mysql.com/doc/refman/5.6/en/string-literals.html (There are several 
ways to include quote characters within a string: )
2012-02-29 14:52:08 +05:30
Praveenkumar Hulakund
9af695fb45 Bug#12601974 - STORED PROCEDURE SQL_MODE=NO_BACKSLASH_ESCAPES IGNORED AND BREAKS REPLICATION
Analysis:
========================
sql_mode "NO_BACKSLASH_ESCAPES": When user want to use backslash as character input,
instead of escape character in a string literal then sql_mode can be set to 
"NO_BACKSLASH_ESCAPES". With this mode enabled, backslash becomes an ordinary 
character like any other. 

SQL_MODE set applies to the current client session. And while creating the stored 
procedure, MySQL stores the current sql_mode and always executes the stored 
procedure in sql_mode stored with the Procedure, regardless of the server SQL 
mode in effect when the routine is invoked.  

In the scenario (for which bug is reported), the routine is created with 
sql_mode=NO_BACKSLASH_ESCAPES. And routine is executed with the invoker sql_mode
is "" (NOT SET) by executing statement "call testp('Axel\'s')".
Since invoker sql_mode is "" (NOT_SET), the '\' in 'Axel\'s'(argument to function)
is considered as escape character and column "a" (of table "t1") values are 
updated with "Axel's". The binary log generated for above update operation is as below,

  set sql_mode=XXXXXX (for no_backslash_escapes)
  update test.t1 set a= NAME_CONST('var',_latin1'Axel\'s' COLLATE 'latin1_swedish_ci');

While logging stored procedure statements, the local variables (params) used in
statements are replaced with the NAME_CONST(var_name, var_value) (Internal function) 
(http://dev.mysql.com/doc/refman/5.6/en/miscellaneous-functions.html#function_name-const)

On slave, these logs are applied. NAME_CONST is parsed to get the variable and its
value. Since, stored procedure is created with sql_mode="NO_BACKSLASH_ESCAPES", the sql_mode
is also logged in. So that at slave this sql_mode is set before executing the statements
of routine.  So at slave, sql_mode is set to "NO_BACKSLASH_ESCAPES" and then while
parsing NAME_CONST of string variable, '\' is considered as NON ESCAPE character
and parsing reported error for "'" (as we have only one "'" no backslash). 

At slave, parsing was proper with sql_mode "NO_BACKSLASH_ESCAPES".
But above error reported while writing bin log, "'" (of Axel's) is escaped with
"\" character. Actually, all special characters (n, r, ', ", \, 0...) are escaped
while writing NAME_CONST for string variable(param, local variable) in bin log 
Airrespective of "NO_BACKSLASH_ESCAPES" sql_mode. So, basically, the problem is 
that logging string parameter does not take into account sql_mode value.

Fix:
========================
So when sql_mode is set to "NO_BACKSLASH_ESCAPES", escaping  characters as 
(n, r, ', ", \, 0...) should be avoided. To do so, added a check to not to
escape such characters while writing NAME_CONST for string variables in bin 
log. 
And when sql_mode is set to NO_BACKSLASH_ESCAPES, quote character "'" is
represented as ''.
http://dev.mysql.com/doc/refman/5.6/en/string-literals.html (There are several 
ways to include quote characters within a string: )
2012-02-29 12:23:15 +05:30
Marko Mäkelä
26ed79ec14 Fix a mistake in the Bug#12861864 fix.
row_drop_table_for_mysql(): Really flag the indexes unavailable before
starting to drop the table.
2012-02-28 21:41:55 +02:00
Karen Langford
bacd6ad2ed AIX builds fail for comments using // 2012-02-28 17:20:30 +01:00
Marko Mäkelä
0664bb7cd0 Bug#12861864 RACE CONDITION IN BTR_GET_SIZE() AND DROP INDEX/TABLE/DATABASE
also filed as Bug#13146269, Bug#13713178

btr_get_size(): Add mtr_t parameter. Require that the caller S-latches
index->lock. If index->page==FIL_NULL or the index is to be dropped,
return ULINT_UNDEFINED to indicate that the statistics are
unavailable.

dict_update_statistics(): If btr_get_size() returns ULINT_UNDEFINED,
fake the index cardinality statistics.

dict_index_set_page(): Unused function, remove.

row_drop_table_for_mysql(): Before starting to drop the table, mark
the indexes unavailable in the data dictionary cache while holding
index->lock X-latch.

ha_innobase::prepare_drop_index(), ha_innobase::final_drop_index():
When setting index->to_be_dropped, acquire the index->lock X-latch.

rb:960 approved by Jimmy Yang
2012-02-28 14:00:00 +02:00
Joerg Bruehe
7fecce51d9 Upmerge the copyright year change, from 5.0 to 5.1. 2012-02-28 12:44:21 +01:00
Joerg Bruehe
b6174b9285 The current year is 2012, and nobody noticed ...
Update the year in the copyright notice, file "README".
2012-02-28 12:42:02 +01:00
Marko Mäkelä
a910b47a8c Remove a bogus BLOB debug assertion that was added in Bug#13721257 fix. 2012-02-27 23:19:14 +02:00
Chaithra Gopalareddy
df8827d0e6 Bug#13012483:EXPLAIN EXTENDED, PREPARED STATEMENT, CRASH IN
CHECK_SIMPLE_EQUALITY

PROBLEM:
Crash in "check_simple_equality" when using a subquery with "IN" and
"ALL" in prepare.

ANALYSIS:
Crash can be reproduced using a simplified query like this one:
prepare s from "select 1 from g1 where 1 < all (
                select @:=(1 in (select 1 from g1)) from g1)";

This bug is currently present only on 5.5.and 5.1. Its fixed as part
of work log(#1110) in 5.6. We are taking one change to fix this
in 5.5 and 5.1.

Problem seems to be present because we are trying to evaluate "is_null"
on an argument which is part of a subquery
(In Item_is_not_null_test::update_used_tables()).
But the condition to evaluate is only when we do not have a sub query
present, which means to say that "with_subselect" is not set.
With respect to the above query, we create an object of type
"Item_in_optimizer" which by definition is always associated with a
subquery. While in 5.6 we set "with_subselect" to true for
"Item_in_optimizer" object, we do not do the same in 5.5. This results in
the evaluation for "is_null" resulting in a coredump.
So, we are now setting "with_subselect" to true for "Item_in_optimizer"
in 5.1 and 5.5.
2012-02-24 11:53:36 +05:30
Tatjana Azundris Nuernberg
eca61722b0 auto-merge 2012-02-22 16:18:12 +01:00
Tor Didriksen
067f83e642 Bug#13519724 63793: CRASH IN DTCOLLATION::SET(DTCOLLATION &SET)
Backport of fix for:
Bug#53236 Segfault in DTCollation::set(DTCollation&)
2012-02-22 11:17:50 +01:00
Vasil Dimov
a66f29c30c Fix Bug#13639142 64128: INNODB ERROR IN SERVER LOG OF INNODB_BUG34300
Suppress innodb_bug34300 from failing if InnoDB prints:

  120221 11:05:03  InnoDB: ERROR: the age of the last checkpoint is 9439048,
  InnoDB: which exceeds the log group capacity 9433498.

by default the log capacity is 2 log files, 5 MB each.
2012-02-21 17:57:07 +02:00
Georgi Kodinov
712e16e558 merged and updated the version in mysql-5.1 2012-02-21 14:14:52 +02:00
Georgi Kodinov
03f48bc650 bumped up the version of the main tree to match the security tree 2012-02-21 14:13:31 +02:00
Georgi Kodinov
ad35745d88 merge 5.0-security->5.1-security 2012-02-21 11:06:08 +02:00
Mattias Jonsson
7e21bee031 Bug#11761296: 53775: QUERY ON PARTITIONED TABLE RETURNS CACHED
RESULT FROM PREVIOUS TRANSACTION

The current Query Cache API is not fully compatible with
the partitioning engine.

There is no good way to implement support for QC due to:
1) a static callback for ha_partition would need to have access
to all partition names and call the underlying callback for each
[sub]partition with the correct name.
2) pruning would be impossible, even if one used the ulonglong
engine_data due to if engine_data is changed, the table is
invalidated by the QC.

So the only viable solution to avoid incorrect data is to not allow
caching of queries using partitioned tables.

(There are some extra changes, due to removal of \r as line break)
2012-02-20 22:59:11 +01:00
Karen Langford
74cf0d02c1 Raise version number after cloning 5.1.62 2012-02-20 17:03:24 +01:00
Sunanda Menon
c16b64c5b9 Raise version number after cloning 5.0.96 2012-02-20 06:19:12 +01:00