Commit graph

25746 commits

Author SHA1 Message Date
Gleb Shchepa
daa6d1f4f3 Bug #55779: select does not work properly in mysql server
Version "5.1.42 SUSE MySQL RPM"

When a query was using a DATE or DATETIME value formatted
using different formatting than "yyyy-mm-dd HH:MM:SS", a
query with a greater-or-equal '>=' condition matched only
greater values in an indexed TIMESTAMP column.

The problem was introduced by the fix for the bug 46362
and partially solved (for DATE and DATETIME columns only)
by the fix for the bug 47925.

The stored_field_cmp_to_item function has been modified
to take into account TIMESTAMP columns like we do for
DATE and DATETIME columns.


mysql-test/r/type_timestamp.result:
  Test case for bug #55779.
mysql-test/t/type_timestamp.test:
  Test case for bug #55779.
sql/item.cc:
  Bug #55779: select does not work properly in mysql server
              Version "5.1.42 SUSE MySQL RPM"
  
  The stored_field_cmp_to_item function has been modified
  to take into account TIMESTAMP columns like we do for
  DATE and DATETIME.
2010-09-13 11:18:35 +04:00
Bjorn Munch
223112ad42 merge 55178,55413,56383 2010-09-10 09:58:26 +02:00
Alexey Kopytov
3ce925bfe7 Automerge. 2010-09-09 16:48:06 +04:00
Alexey Kopytov
453107bc56 Bug #54190: Comparison to row subquery produces incorrect
result

Row subqueries producing no rows were not handled as UNKNOWN
values in row comparison expressions.

That was a result of the following two problems:

1. Item_singlerow_subselect did not mark the resulting row
value as NULL/UNKNOWN when no rows were produced.

2. Arg_comparator::compare_row() did not take into account that
a whole argument may be NULL rather than just individual scalar
values.

Before bug#34384 was fixed, the above problems were hidden
because an uninitialized (i.e. without any stored value) cached
object would appear as NULL for scalar values in a row subquery
returning an empty result. After the fix
Arg_comparator::compare_row() would try to evaluate
uninitialized cached objects.

Fixed by removing the aforementioned problems.


mysql-test/r/row.result:
  Added a test case for bug #54190.
mysql-test/r/subselect.result:
  Updated the result for a test relying on wrong behavior.
mysql-test/t/row.test:
  Added a test case for bug #54190.
sql/item_cmpfunc.cc:
  If either of the argument rows is NULL, return NULL as the
  result of comparison.
sql/item_subselect.cc:
  Adjust null_value for Item_singlerow_subselect depending on
  whether a row has been produced by the row subquery.
2010-09-09 16:46:13 +04:00
Martin Hansson
4f4d03a416 Bug#51070: Query with a NOT IN subquery predicate returns a wrong result set
The EXISTS transformation has additional switches to catch the known corner
cases that appear when transforming an IN predicate into EXISTS. Guarded
conditions are used which are deactivated when a NULL value is seen in the
outer expression's row. When the inner query block supplies NULL values,
however, they are filtered out because no distinction is made between the
guarded conditions; guarded NOT x IS NULL conditions in the HAVING clause that
filter out NULL values cannot be de-activated in isolation from those that
match values or from the outer expression or NULL's.

The above problem is handled by making the guarded conditions remember whether
they have rejected a NULL value or not, and index access methods are taking
this into account as well. 

The bug consisted of 

1) Not resetting the property for every nested loop iteration on the inner
   query's result.

2) Not propagating the NULL result properly from inner query to IN optimizer.

3) A hack that may or may not have been needed at some point. According to a
   comment it was aimed to fix #2 by returning NULL when FALSE was actually
   the result. This caused failures when #2 was properly fixed. The hack is
   now removed.

The fix resolves all three points.
2010-09-07 11:21:09 +02:00
Dmitry Shulga
d6f6db6f4c Fixed bug #55421 - Protocol::end_statement(): Assertion `0' on
multi-table UPDATE IGNORE.
The problem was that if there was an active SELECT statement
during trigger execution, an error risen during the execution
may cause a crash. The fix is to temporary reset LEX::current_select
before trigger execution and restore it afterwards. This way
errors risen during the trigger execution are processed as
if there was no active SELECT.

mysql-test/r/trigger_notembedded.result:
  added test case result for bug #55421.
mysql-test/t/trigger_notembedded.test:
  added test case for bug #55421.
sql/sql_trigger.cc:
  Reset thd->lex->current_select before start trigger execution
  and restore its original value after execution is finished.
  This is neccessery in order to set error status in 
  diagnostic_area in case of trigger execution failure.
2010-09-07 15:53:46 +07:00
Martin Hansson
446cc653c0 Bug#54543: update ignore with incorrect subquery leads to assertion failure:
inited==INDEX

When an error occurs while sending the data in a temporary table there was no
cleanup performed. This caused a failed assertion in the case when different
access methods were used for populating the table vs. retrieving the data from
the table if IGNORE was specified and sql_safe_updates = 0. In this case
execution continues, but the handler expects to continue with the access
method used for row retrieval.

Fixed by doing the cleanup even if errors occur.
2010-09-07 09:58:05 +02:00
Magne Mahre
64b639260c Bug#39932 "create table fails if column for FK is in different
case than in corr index".
      
Server was unable to find existing or explicitly created supporting
index for foreign key if corresponding statement clause used field
names in case different than one used in key specification and created
yet another supporting index.
In cases when name of constraint (and thus name of generated index)
was the same as name of existing/explicitly created index this led
to duplicate key name error.
      
The problem was that unlike all other code Key_part_spec::operator==()
compared field names in case sensitive fashion. As result routines
responsible for getting rid of redundant generated supporting indexes
for foreign key were not working properly for versions of field names
using different cases.

(backported from mysql-trunk)


sql/sql_class.cc:
  Make field name comparison case-insensitive like it is
  in the rest of server.
2010-09-01 19:38:34 +02:00
Bjorn Munch
7749cd8fd8 Bug #56383 provide option to restart mysqld after each mtr test
Added --force-restart
2010-08-31 11:27:57 +02:00
Bjorn Munch
6d2ff118bc merge 55413 2010-08-30 11:26:40 +02:00
Bjorn Munch
93b8156365 Bug #55178 Set timeout on test-to-test-basis
Allow --testcase-timeout=<mins> to be set in .opt file for test
2010-08-30 11:25:10 +02:00
Bjorn Munch
09c62e4ff8 Cherry pick 55501 2010-08-25 16:34:31 +02:00
Gleb Shchepa
cfcc7e265e automerge local --> 5.1-bugteam (bug 53034) 2010-08-31 02:32:03 +04:00
Gleb Shchepa
ccab4d8771 Bug #53034: Multiple-table DELETE statements not accepting
"Access compatibility" syntax

The "wild" "DELETE FROM table_name.* ... USING ..." syntax
for multi-table DELETE statements is documented but it was
lost in the fix for the bug 30234.

The table_ident_opt_wild parser rule has been added
to restore the lost syntax.


mysql-test/r/delete.result:
  Test case for bug #53034.
mysql-test/t/delete.test:
  Test case for bug #53034.
sql/sql_yacc.yy:
  Bug #53034: Multiple-table DELETE statements not accepting
              "Access compatibility" syntax
  
  The table_ident_opt_wild parser rule has been added
  to restore the lost syntax.
  Note: simple extending of table_ident with opt_wild in
  the table_alias_ref rule is not acceptable, because
  a) it adds one conflict more and b) this conflict resolves
  in the inappropriate way.
2010-08-31 02:16:38 +04:00
Ramil Kalimullin
ed8aa284ba Automerge. 2010-08-30 12:08:28 +04:00
Ramil Kalimullin
6a113b215a Fix for bug #51875: crash when loading data into geometry function polyfromwkb
Check for number of line strings in the incoming polygon data (wkb) and
for number of points in the incoming linestring wkb.



mysql-test/r/gis.result:
  Fix for bug #51875: crash when loading data into geometry function polyfromwkb
    - test result.
mysql-test/t/gis.test:
  Fix for bug #51875: crash when loading data into geometry function polyfromwkb
    - test case.
sql/spatial.cc:
  Fix for bug #51875: crash when loading data into geometry function polyfromwkb
    - creating a polygon from wkb check for number of line strings,
    - creating a linestring from wkb check for number of line points.
2010-08-30 11:51:46 +04:00
Alexey Kopytov
c1bd124c68 Automerge. 2010-08-30 11:19:09 +04:00
Vasil Dimov
3bc7c50813 Merge mysql-5.1-innodb -> mysql-5.1-bugteam 2010-08-28 00:58:46 +03:00
Alexey Kopytov
d7d0f6390b Bug #54465: assert: field_types == 0 || field_types[field_pos]
== MYSQL_TYPE_LONGLONG

A MIN/MAX() function with a subquery as its argument could lead
to a debug assertion on debug builds or wrong data on release
ones.

The problem was a combination of the following factors:

- Item_sum_hybrid::fix_fields() might use the argument
(args[0]) to calculate 'hybrid_field_type' which was later used
to decide how the data should be sent to the client.

- Item_sum::make_field() might use the argument again to
calculate the field's type when sending result set metadata to
the client.

- The argument could be changed in between these two calls via
  Item::set_arg() leading to inconsistent metadata being
  reported.

Here is what was happening for the bug's test case:

1. Item_sum_hybrid::fix_fields() calculates hybrid_field_type
as MYSQL_TYPE_LONGLONG based on args[0] which is an
Item::SUBSELECT_ITEM at that time.

2. A temporary table is created to execute the
query. create_tmp_field_from_item() creates a Field_long object
according to the subselect's max_length.

3. The subselect item in Item_sum_hybrid is replaced by the
Item_field object referencing the newly created Field_long.

4. Item_sum::make_field() rightfully returns the
MYSQL_TYPE_LONG type when calculating the result set metadata.

5. When sending the actual data, Item::send() relies on the
virtual field_type() function which in our case returns
previously calculated hybrid_field_type == MYSQL_TYPE_LONGLONG.

It looks like the only solution is to never refer to the
argument's metadata after the result metadata has been
calculated in fix_fields(), since the argument itself may be
different by then. In this sense, Item_sum::make_field() should
never be used, because it may rely on the argument's metadata
and is only called after fix_fields(). The "default"
implementation in Item::make_field() should be used instead as
it relies only on field_type(), but not on the argument's type.

Fixed by removing Item_sum::make_field() so that the superclass
implementation Item::make_field() is always used.

mysql-test/r/func_group.result:
  Added a test case for bug #54465.
mysql-test/t/func_group.test:
  Added a test case for bug #54465.
sql/item_sum.cc:
  Removed Item_sum::make_field() so that the superclass
  implementation Item::make_field() is always used.
sql/item_sum.h:
  Removed Item_sum::make_field() so that the superclass
  implementation Item::make_field() is always used.
2010-08-27 13:44:35 +04:00
Alexey Kopytov
27d5b6e57f Automerge. 2010-08-26 16:36:48 +04:00
Sergey Vojtovich
d1fb4ba299 Fixed race condition in a test case for BUG#55580. 2010-08-26 15:23:44 +04:00
Evgeny Potemkin
b4dc600af9 Bug #55656: mysqldump can be slower after bug 39653 fix.
After fix for bug 39653 the shortest available secondary index was used for
full table scan. Primary clustered key was used only if no secondary index
can be used. However, when chosen secondary index includes all fields of the
table being scanned it's better to use primary index since the amount of
data to scan is the same but the primary index is clustered.
Now the find_shortest_key function takes this into account.


mysql-test/suite/innodb/r/innodb_mysql.result:
  Added a test case for the bug#55656.
mysql-test/suite/innodb/t/innodb_mysql.test:
  Added a test case for the bug#55656.
sql/sql_select.cc:
  Bug #55656: mysqldump can be slower after bug #39653 fix.
  The find_shortest_key function now prefers clustered primary key
  if found secondary key includes all fields of the table.
2010-08-26 13:31:04 +04:00
Alexey Kopytov
e7b2688271 Bug #54802: 'NOT BETWEEN' evaluation is incorrect
Queries involving predicates of the form "const NOT BETWEEN
not_indexed_column AND indexed_column" could return wrong data
due to incorrect handling by the range optimizer.

For "c NOT BETWEEN f1 AND f2" predicates, get_mm_tree()
produces a disjunction of the SEL_ARG trees for "f1 > c" and
"f2 < c". If one of the trees is empty (i.e. one of the
arguments is not sargable) the resulting tree should be empty
as well, since the whole expression in this case is not
sargable.

The above logic is implemented in get_mm_tree() as follows. The
initial state of the resulting tree is NULL (aka empty). We
then iterate through arguments and compute the corresponding
SEL_ARG tree (either "f1 > c" or "f2 < c"). If the resulting
tree is NULL, it is simply replaced by the generated
tree. Otherwise it is replaced by a disjunction of itself and
the generated tree. The obvious flaw in this implementation is
that if the first argument is not sargable and thus produces a
NULL tree, the resulting tree will simply be replaced by the
tree for the second argument. As a result, "c NOT BETWEEN f1
AND f2" will end up as just "f2 < c".

Fixed by adding a check so that when the first argument
produces an empty tree for the NOT BETWEEN case, the loop is
aborted with an empty tree as a result. The whole idea of using
a loop for 2 arguments does not make much sense, but it was
probably used to avoid code duplication for several BETWEEN
variants.
2010-08-24 19:51:32 +04:00
Mattias Jonsson
bc05efd8aa post push test fix 2010-08-20 21:17:51 +02:00
Georgi Kodinov
7d3a9b4cf6 merge 2010-08-20 12:09:17 +03:00
Mattias Jonsson
dd9329761a merge 2010-08-19 09:20:17 +02:00
unknown
9d6811502e WL#5370 Keep forward-compatibility when changing
'CREATE TABLE IF NOT EXISTS ... SELECT' behaviour
BUG#55474, BUG#55499, BUG#55598, BUG#55616 and BUG#55777 are fixed
in this patch too.

This is the 5.1 part.
It implements:
- if the table exists, binlog two events: CREATE TABLE IF NOT EXISTS
  and INSERT ... SELECT

- Insert nothing and binlog nothing on master if the existing object
  is a view. It only generates a warning that table already exists.


mysql-test/r/trigger.result:
  Ather this patch, 'CREATE TABLE IF NOT EXISTS ... SELECT' will not
  insert anything if the creating table already exists and is a view.
sql/sql_class.h:
  Declare virtual function write_to_binlog() for select_insert.
  It's used to binlog 'create select'
sql/sql_insert.cc:
  Implement write_to_binlog();
  Use write_to_binlog() instead of binlog_query() to binlog the statement.
  if the table exists, binlog two events: CREATE TABLE IF NOT EXISTS
  and INSERT ... SELECT
sql/sql_lex.h:
  Declare create_select_start_with_brace and create_select_pos.
  They are helpful for binlogging 'create select'
sql/sql_parse.cc:
  Do nothing on master if the existing object is a view.
sql/sql_yacc.yy:
  Record the relative postion of 'SELECT' in the 'CREATE ...SELECT' statement.
  Record whether there is a '(' before the 'SELECT' clause.
2010-08-18 12:56:06 +08:00
Vasil Dimov
61f842444c Disable all innodb_plugin tests on Solaris until the problem is resolved.
Track this via:
Bug#56063 InnoDB Plugin mysql-tests fail on Solaris
2010-08-17 22:37:18 +03:00
Georgi Kodinov
790852c0c9 Bug #55580 : segfault in read_view_sees_trx_id
The server was not checking for errors generated during
the execution of Item::val_xxx() methods when copying
data to the group, order, or distinct temp table's row.
Fixed by extending the copy_funcs() to return an error
code and by checking for that error code on the places
copy_funcs() is called. 
Test case added.
2010-08-13 11:07:39 +03:00
Georgi Kodinov
8b25c0e4dc Bug #55565: debug assertion when ordering by expressions with user
variable assignments

The assert() that is firing is checking if expressions that can't be
null return a NULL when evaluated.
MAKEDATE() function can return NULL if the second argument is 
less then or equal to 0. Thus its nullability depends not only on 
the nullability of its arguments but also on their values.
Fixed by (overoptimistically) setting MAKEDATE() to be nullable 
despite the nullability of its arguments.
Test added.
Had to update one test result to reflect the metadata change.
2010-08-13 16:05:46 +03:00
Martin Hansson
41cfa3e769 Bug#54444: Do not run main.range test for products without partitioning
feature

The test for bug no 50939 was put in range.test which isn't such a good idea
since it requires partitioning. Fixed by moving the test case to
partitioning_range.test.
2010-08-11 14:13:59 +02:00
Bjorn Munch
788b4e404b Bug #55413 mysqltest gives parse error for lines matching "^let.*\\.*;$"
Allow escaped quotes also in statements not starting with --
But will not support single unescaped ' or `
2010-08-10 12:13:58 +02:00
Jon Olav Hauglid
d62bfebc7e Bug #54106 assert in Protocol::end_statement,
INSERT IGNORE ... SELECT ... UNION SELECT ...

This assert was triggered by INSERT IGNORE ... SELECT. The assert checks that a
statement either sends OK or an error to the client. If the bug was triggered
on release builds, it caused OK to be sent to the client instead of the correct
error message (in this case ER_FIELD_SPECIFIED_TWICE).

The reason the assert was triggered, was that lex->no_error was set to TRUE
during JOIN::optimize() because of IGNORE. This causes all errors to be ignored.
However, not all errors can be ignored. Some, such as ER_FIELD_SPECIFIED_TWICE
will cause the INSERT to fail no matter what. But since lex->no_error was set,
the critical errors were ignored, the INSERT failed and neither OK nor the
error message was sent to the client.

This patch fixes the problem by temporarily turning off lex->no_error in
places where errors cannot be ignored during processing of INSERT ... SELECT.

Test case added to insert.test.
2010-08-09 13:39:59 +02:00
Bjorn Munch
59a63f0597 Bug #55503 MTR fails to filter LEAK SUMMARY from valgrind report of restarted servers
Undo workaround as fix is being merged in
2010-08-06 11:35:17 +02:00
Bjorn Munch
3d0819e2b1 merge from 5.1-mtr 2010-08-06 11:13:52 +02:00
Martin Hansson
0c81dcf332 Bug#54568: create view cause Assertion failed: 0,
file .\item_subselect.cc, line 836

IN quantified predicates are never executed directly. They are rather wrapped
inside nodes called IN Optimizers (Item_in_optimizer) which take care of the
execution. However, this is not done during query preparation. Unfortunately
the LIKE predicate pre-evaluates constant right-hand side arguments even
during name resolution. Likely this is meant as an optimization.

Fixed by not pre-evaluating LIKE arguments in view prepare mode.
2010-08-05 12:42:14 +02:00
Bjorn Munch
f3f5e04a36 merge from 5.1 2010-08-04 12:19:51 +02:00
Bjorn Munch
2d2da6e793 Bug #55582 mtr root detection (and if-expression execution) broken
Follow-up patch: added test cases for -0 and while
2010-08-04 10:52:45 +02:00
Georgi Kodinov
5eeb6488cf Bug #42144: plugin_load fails
The enum system variables were handled inconsistently 
as ints, unsigned int and unsigned long on various places.
This caused problems on platforms on which 
sizeof(int) != sizeof(long).
Fixed by homogenizing the type of the enum variables
to unsigned int, since it's size compatible with the C enum
type. 
Removed the test from the experimental list.
2010-08-03 19:01:30 +03:00
Bjorn Munch
5e92df6e0e Bug #55582 mtr root detection (and if-expression execution) broken
if() treated any non-numeric string as false
Fixed to treat those as true instead
Added some test cases
Fixed missing $ in variable name in include/mix2.inc
2010-08-03 16:11:23 +02:00
Alfranio Correia
7909541953 auto-merge mysql-5.1-security (local) --> mysql-5.1-security 2010-08-03 12:52:02 +01:00
unknown
60ab046abc Bug #34283 mysqlbinlog leaves tmpfile after termination if binlog contains load data infile
Post fix

mysql-test/t/mysqlbinlog.test:
  Updated for Bug#34283
2010-08-03 18:27:45 +08:00
unknown
bcb3170c97 Bug #34283 mysqlbinlog leaves tmpfile after termination if binlog contains load data infile
With statement- or mixed-mode logging, "LOAD DATA INFILE" queries
are written to the binlog using special types of log events.
When mysqlbinlog reads such events, it re-creates the file in a
temporary directory with a generated filename and outputs a
"LOAD DATA INFILE" query where the filename is replaced by the
generated file. The temporary file is not deleted by mysqlbinlog
after termination.

To fix the problem, in mixed mode we go to row-based. In SBR, we
document it to remind user the tmpfile is left in a temporary
directory.




mysql-test/extra/rpl_tests/rpl_loaddata.test:
  Updated for Bug#34283
mysql-test/suite/binlog/r/binlog_mixed_load_data.result:
  Test result for BUG#34283.
mysql-test/suite/binlog/t/binlog_killed_simulate.test:
  Updated for Bug#34283
mysql-test/suite/binlog/t/binlog_mixed_load_data.test:
  Added the test file to verify that 'load data infile...' statement
  will go to row-based in mixed mode.
mysql-test/suite/binlog/t/binlog_stm_blackhole.test:
  Updated for Bug#34283
mysql-test/suite/rpl/r/rpl_innodb_mixed_dml.result:
  Updated for Bug#34283
mysql-test/suite/rpl/t/rpl_loaddata_fatal.test:
  Updated for Bug#34283
mysql-test/suite/rpl/t/rpl_loaddata_map.test:
  Updated for Bug#34283
mysql-test/suite/rpl/t/rpl_slave_load_remove_tmpfile.test:
  Updated for Bug#34283
mysql-test/suite/rpl/t/rpl_stm_log.test:
  Updated for Bug#34283
sql/sql_load.cc:
  Added code to go to row-based in mixed mode for
  'load data infile ...' statement
2010-08-03 10:22:19 +08:00
Alfranio Correia
f62e89fade BUG#55625 RBR breaks on failing 'CREATE TABLE'
A CREATE...SELECT that fails is written to the binary log if a non-transactional
statement is updated. If the logging format is ROW, the CREATE statement and the
changes are written to the binary log as distinct events and by consequence the
created table is not rolled back in the slave.

In this patch, we opted to let the slave goes out of sync by not writting to the
binary log the CREATE statement. We do this by simply reseting the binary log's
cache.

mysql-test/suite/rpl/r/rpl_drop.result:
  Added a test case.
mysql-test/suite/rpl/t/rpl_drop.test:
  Added a test case.
sql/log.cc:
  Introduced a function to clean up the cache.
sql/log.h:
  Introduced a function to clean up the cache.
sql/sql_insert.cc:
  Cleaned up the binary log cache if a CREATE...SELECT fails.
2010-08-02 20:48:56 +01:00
Bjorn Munch
f3d4e72cf1 Bug #55597 MTR: Restart the server, from within the test case, with new CLI options.
The expect file can now include "restart:<server options>"
Also drop check-testcase if this has been done
Added comment explaining the restart: syntax
2010-08-02 12:43:28 +02:00
Georgi Kodinov
4f738e9b7c merge mysql-5.1-bugteam into mysql-5.1-security 2010-08-02 10:50:15 +03:00
Gleb Shchepa
80aa882497 Bug #54461: crash with longblob and union or update with subquery
Queries may crash, if
  1) the GREATEST or the LEAST function has a mixed list of
     numeric and LONGBLOB arguments and
  2) the result of such a function goes through an intermediate
     temporary table.

An Item that references a LONGBLOB field has max_length of
UINT_MAX32 == (2^32 - 1).

The current implementation of GREATEST/LEAST returns REAL
result for a mixed list of numeric and string arguments (that
contradicts with the current documentation, this contradiction
was discussed and it was decided to update the documentation).

The max_length of such a function call was calculated as a
maximum of argument max_length values (i.e. UINT_MAX32).

That max_length value of UINT_MAX32 was used as a length for
the intermediate temporary table Field_double to hold
GREATEST/LEAST function result.

The Field_double::val_str() method call on that field
allocates a String value.

Since an allocation of String reserves an additional byte
for a zero-termination, the size of String buffer was
set to (UINT_MAX32 + 1), that caused an integer overflow:
actually, an empty buffer of size 0 was allocated.

An initialization of the "first" byte of that zero-size
buffer with '\0' caused a crash.

The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.


******
Bug #54461: crash with longblob and union or update with subquery

Queries may crash, if
  1) the GREATEST or the LEAST function has a mixed list of
     numeric and LONGBLOB arguments and
  2) the result of such a function goes through an intermediate
     temporary table.

An Item that references a LONGBLOB field has max_length of
UINT_MAX32 == (2^32 - 1).

The current implementation of GREATEST/LEAST returns REAL
result for a mixed list of numeric and string arguments (that
contradicts with the current documentation, this contradiction
was discussed and it was decided to update the documentation).

The max_length of such a function call was calculated as a
maximum of argument max_length values (i.e. UINT_MAX32).

That max_length value of UINT_MAX32 was used as a length for
the intermediate temporary table Field_double to hold
GREATEST/LEAST function result.

The Field_double::val_str() method call on that field
allocates a String value.

Since an allocation of String reserves an additional byte
for a zero-termination, the size of String buffer was
set to (UINT_MAX32 + 1), that caused an integer overflow:
actually, an empty buffer of size 0 was allocated.

An initialization of the "first" byte of that zero-size
buffer with '\0' caused a crash.

The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.



mysql-test/r/func_misc.result:
  Test case for bug #54461.
  
  ******
  Test case for bug #54461.
mysql-test/t/func_misc.test:
  Test case for bug #54461.
  
  ******
  Test case for bug #54461.
sql/item_func.cc:
  Bug #54461: crash with longblob and union or update with subquery
  
  The Item_func_min_max::fix_length_and_dec() has been
  modified to calculate max_length for the REAL result like
  we do it for arithmetical operators.
  
  ******
  Bug #54461: crash with longblob and union or update with subquery
  
  The Item_func_min_max::fix_length_and_dec() has been
  modified to calculate max_length for the REAL result like
  we do it for arithmetical operators.
2010-08-01 22:12:36 +04:00
Luis Soares
655d913bfc Automerge mysql-5.1-bugteam into mysql-5.1-bugteam latest. 2010-07-30 15:32:28 +01:00
Georgi Kodinov
ae02cad707 Disable the tests failing under valgrind because of bug #55503 2010-07-30 17:09:24 +03:00
Luis Soares
55e60e14fa Revert patch for BUG#34283. Causing lots of test failures in PB2,
mostly because existing test result files were not updated.
2010-07-30 14:44:39 +01:00