Commit graph

19436 commits

Author SHA1 Message Date
Magne Mahre
6503226743 Bug#48053 String::c_ptr has a race and/or does an invalid
memory reference

There are two issues present here.
  1) There is a possibility that we test a byte beyond the
     allocated buffer

  2) We compare a byte that might never have been
     initalized to see if it's 0.

The first issue is not triggered by existing code, but an
ASSERT has been added to safe-guard against introducing
new code that triggers it.

The second issue is what triggers the Valgrind warnings
reported in the bug report. A buffer is allocated in
class String to hold the value. This buffer is populated
by the character data constituting the string, but is not
zero-terminated in most cases.  Testing if it is indeed
zero-terminated means that we check a byte that has never
been explicitly set, thus causing Valgrind to trigger.

Note that issue 2 is not a serious problem.  The variable
is read, and if it's not zero, we will set it to zero.
There are no further consequences.

Note that this patch does not fix the underlying problems
with issue 1, as it is deemed too risky to fix at this
point (as noted in the bug report).  As discussed in
the report, the c_ptr() method should probably be
replaced, but this requires a thorough analysis of the
~200 calls to the method.


sql/set_var.cc:
  These two cases have been reported to fail
  with Valgrind.
2011-02-17 12:43:53 +01:00
Bjorn Munch
ee2f9d868c Simple fix of suppress pattern in test insert_select 2011-02-16 21:43:12 +01:00
Dmitry Lenev
9c89cca5e3 Fix for bug#11766714 (former bug @59888) "debug assertion when
attempt to create spatial index on char > 31 bytes".

Attempt to create spatial index on char field with length
greater than 31 byte led to assertion failure on server
compiled with safemutex support.

The problem occurred in mi_create() function which was called
to create a new version of table being altered. This function
failed since it detected an attempt to create a spatial key
on non-binary column and tried to return an error.
On its error path it tried to unlock THR_LOCK_myisam mutex
which has not been not locked at this point. Indeed such an
incorrect behavior was caught by safemutex wrapper and caused
assertion failure.

This patch fixes the problem by ensuring that mi_create()
doesn't releases THR_LOCK_myisam mutex on error path if it was
not acquired.

mysql-test/r/gis.result:
  Added test for bug @59888 "debug assertion when attempt to
  create spatial index on char > 31 bytes".
mysql-test/t/gis.test:
  Added test for bug @59888 "debug assertion when attempt to
  create spatial index on char > 31 bytes".
storage/myisam/mi_create.c:
  Changed mi_create() not to release THR_LOCK_myisam mutex on
  error path if it was not acquired.
2011-02-15 14:03:05 +03:00
Georgi Kodinov
6b1b898ef6 weave merge mysql-5.1->mysql-5.1-security 2011-02-09 10:30:44 +02:00
unknown
17fe23e46c Merge from mysql-5.1.55-release 2011-02-08 12:52:33 +01:00
Dmitry Lenev
f74fd118cf Merged fix for bug #36544 "DROP USER does not remove stored
function privileges" into 5.5 tree. Did after-merge fixes.
2011-02-07 15:06:22 +03:00
Dmitry Lenev
b169b8d853 Fix for bug#36544 "DROP USER does not remove stored function
privileges".

The first problem was that DROP USER didn't properly remove privileges 
on stored functions from in-memory structures. So the dropped user
could have called stored functions on which he had privileges before
being dropped while his connection was still around.
Even worse if a new user with the same name was created he would
inherit privileges on stored functions from the dropped user.
Similar thing happened with old user name and function privileges
during RENAME USER.

This problem stemmed from the fact that the handle_grant_data() function
which handled DROP/RENAME USER didn't take any measures to update
in-memory hash with information about function privileges after
updating them on disk.

This patch solves this problem by adding code doing just that.

The second problem was that RENAME USER didn't properly update in-memory
structures describing table-level privileges and privileges on stored 
procedures. As result such privileges could have been lost after a rename
(i.e. not associated with the new name of user) and inherited by a new
user with the same name as the old name of the original user.

This problem was caused by code handling RENAME USER in
handle_grant_struct() which [sic!]:
a) tried to update wrong (tables) hash when updating stored procedure
   privileges for new user name.
b) passed wrong arguments to function performing the hash update and
   didn't take into account the way in which such update could have
   changed the order of the hash elements.

This patch solves this problem by ensuring that a) the correct hash
is updated, b) correct arguments are used for the hash_update()
function and c) we take into account possible changes in the order
of hash elements.

mysql-test/r/grant.result:
  Added test coverage for bug#36544 "DROP USER does not remove stored
  function privileges".
mysql-test/suite/funcs_1/r/innodb_storedproc_06.result:
  Since after fixing bug#36544 "DROP USER does not remove stored function
  privileges" in-memory structures are correctly updated by DROP USER,
  DROP FUNCTION performed after DROP USER for its definer no longer
  produces unwarranted warning/error messages.
mysql-test/suite/funcs_1/r/memory_storedproc_06.result:
  Since after fixing bug#36544 "DROP USER does not remove stored function
  privileges" in-memory structures are correctly updated by DROP USER,
  DROP FUNCTION performed after DROP USER for its definer no longer
  produces unwarranted warning/error messages.
mysql-test/suite/funcs_1/r/myisam_storedproc_06.result:
  Since after fixing bug#36544 "DROP USER does not remove stored function
  privileges" in-memory structures are correctly updated by DROP USER,
  DROP FUNCTION performed after DROP USER for its definer no longer
  produces unwarranted warning/error messages.
mysql-test/t/grant.test:
  Added test coverage for bug#36544 "DROP USER does not remove stored
  function privileges".
sql/sql_acl.cc:
  Changed handle_grant_data() to also update hash with function 
  privileges. This allows DROP/RENAME USER correctly keep this 
  in-memory structure up-to-date.
  
  To do this extended handle_grant_struct() to support updating of this
  hash. In addition fixed code in this function which is responsible for 
  handling of column and routine hashes during RENAME USER, ensured that
  we correctly update these hashes after changing user name and that we
  don't skip elements while iterating through the hash and doing updates.
2011-02-07 14:01:19 +03:00
Ole John Aske
221ce9223d Fix for bug#59308: Incorrect result for SELECT DISTINCT <col>... ORDER BY <col> DESC.
Also fix bug#59110: Memory leak of QUICK_SELECT_I allocated memory.
Includes Jørgen Lølands review comments.
      
Root cause of these bugs are that test_if_skip_sort_order() decided to
revert the 'skip_sort_order' descision (and use filesort) after the
query plan has been updated to reflect a 'skip' of the sort order.
      
This might happen in 'check_reverse_order:' if we have a 
select->quick which could not be made descending by appending 
a QUICK_SELECT_DESC. ().
      
The original 'save_quick' was then restored after the QEP has been modified,
which caused:
      
  - An incorrect 'precomputed_group_by= TRUE' may have been set, 
    and not reverted, as part of the already modifified QEP (Bug#59308)
  - A 'select->quick' might have been created which we fail to delete (bug#59110).
      
This fix is a refactorication of test_if_skip_sort_order() where all logic
related to modification of QEP (controlled by argument 'bool no_changes'), is
moved to the end of test_if_skip_sort_order(), and done after *all* 'test_if_skip'
checks has been performed - including the 'check_reverse_order:' checks.
      
The refactorication above contains now intentional changes to the logic which 
has been moved to the end of the function.
      
Furthermore, a smaller part of the fix address the handling of the 
select->quick objects which may already exists when we call 
'test_if_skip_sort_order()' (save_quick) -and
new select->quick's created during test_if_skip_sort_order():
      
  - Before new select->quick may be created by calling ::test_quick_select(), we
    set 'select->quick= 0' to avoid that ::test_quick_select() prematurely
    delete the save_quick's. (After this call we may have both a 'save_quick' 
    and 'select->quick')
      
  - All returns from ::test_if_skip_sort_order() where we may have both a
    'save_quick' and a 'select->quick' has been changed to goto's to the
    exit points 'skiped_sort_order:' or 'need_filesort:' where we
    decide which of the QUICK_SELECT's to keep, and delete the other.
2011-02-07 10:36:21 +01:00
Dmitry Shulga
378091e434 Fixed bug#58026 - massive recursion and crash in regular expression
handling.

The problem was that parsing of nested regular expression involved
recursive calls. Such recursion didn't take into account the amount of
available stack space, which ended up leading to stack overflow crashes.

mysql-test/t/not_embedded_server.test:
  Added test for bug#58026.
regex/my_regex.h:
  added pointer to function as last argument of my_regex_init() for check
  enough memory in stack.
regex/regcomp.c:
  p_ere() was modified: added call to function for check enough memory
  in stack. Function for check available stack space specified by
  global variable my_regex_enough_mem_in_stack. This variable set to
  NULL for embedded mysqld and to a pointer to function
  check_enough_stack_size otherwise.
regex/reginit.c:
  my_regex_init was modified: pass a pointer to a function for check
  enough memory in stack space. Reset this pointer to NULL in my_regex_end.
sql/mysqld.cc:
  Added function check_enough_stack_size() for check enough memory in stack.
  Passed this function as second argument to my_regex_init. For embedded 
  mysqld passed NULL as second argument.
2011-02-04 10:47:46 +06:00
Georgi Kodinov
a265fde655 merge 2011-02-02 20:13:11 +02:00
Georgi Kodinov
0a8419dfdd Bug #52315 part 2 addendum : reset back the timestamp 2011-02-02 20:10:57 +02:00
Georgi Kodinov
72ae1d65dd merge to 5.1. 2011-02-02 19:05:28 +02:00
Georgi Kodinov
a70c34bf0f Fixes for Bug #55755 and Bug #52315 part 2
Bug #55755 : Date STD variable signness breaks server on FreeBSD and OpenBSD

* Added a check to configure on the size of time_t
* Created a macro to check for a valid time_t that is safe to use with datetime 
  functions and store in TIMESTAMP columns.
* Used the macro consistently instead of the ad-hoc checks introduced by 52315
* Fixed compliation warnings on platforms where the size of time_t is smaller than
  the size of a long (e.g. OpenBSD 4.8 64 amd64).

Bug #52315: utc_date() crashes when system time > year 2037

* Added a correct check for the timestamp range instead of just variable size check to
SET TIMESTAMP.
* Added overflow checking before converting to time_t. 
* Using a correct localized error message in this case instead of the generic error.
* Added a test suite.
* fixed the checks so that they check for unsigned time_t as well. Used the checks 
  consistently across the source code.
* fixed the original test case to expect the new error code.
2011-02-02 18:51:35 +02:00
Dmitry Lenev
e805a0fd9d Fix for bug #58650 "Failing assertion: primary_key_no == -1 ||
primary_key_no == 0".

Attempt to create InnoDB table with non-nullable column of
geometry type having an unique key with length 12 on it and
with some other candidate key led to server crash due to
assertion failure in both non-debug and debug builds.

The problem was that such a non-candidate key could have
been sorted as the first key in table/.FRM, before any legit
candidate keys. This resulted in assertion failure in InnoDB
engine which assumes that primary key should either be the
first key in table/.FRM or should not exist at all.

The reason behind such an incorrect sorting was an wrong
value of Create_field::key_length member for geometry field
(which was set to its pack_length == 12) which confused code
in mysql_prepare_create_table(), so it would skip marking
such key as a key with partial segments.

This patch fixes the problem by ensuring that this member
gets the same value of Create_field::key_length member as 
for other blob fields (from which geometry field class is
inherited), and as result unique keys on geometry fields
are correctly marked as having partial segments.


mysql-test/include/gis_keys.inc:
  Added test case for bug #58650 "Failing assertion:
  primary_key_no == -1 || primary_key_no == 0".
mysql-test/r/gis.result:
  Added test case for bug #58650 "Failing assertion:
  primary_key_no == -1 || primary_key_no == 0".
mysql-test/suite/innodb/r/innodb_gis.result:
  Added test case for bug #58650 "Failing assertion:
  primary_key_no == -1 || primary_key_no == 0".
mysql-test/suite/innodb_plugin/r/innodb_gis.result:
  Added test case for bug #58650 "Failing assertion:
  primary_key_no == -1 || primary_key_no == 0".
sql/field.cc:
  Changed Create_field::create_length_to_internal_length() to
  correctly set Create_field::key_length member for geometry
  fields. Similar to the blob types key_length for such fields
  should be the same as length and not field's packed length
  (which is always 12 for geometry).
  
  As result of this change code handling table creation now
  always correctly identifies btree/unique keys on geometry
  fields as partial keys, so such keys can't be erroneously
  treated as candidate keys and sorted in keys array in .FRM
  before legit candidate keys.
  
  This fixes bug #58650 "Failing assertion: primary_key_no ==
  -1 || primary_key_no == 0" in which incorrect candidate key
  sorting led to assertion failure in InnoDB code.
2011-02-02 16:17:48 +03:00
Ole John Aske
59269b1da1 Fix for bug#57030: ('BETWEEN' evaluation is incorrect')
Root cause for this bug is that the optimizer try to detect&
optimize the special case:
      
'<field>  BETWEEN c1 AND c1' and handle this as the condition '<field>  = c1'
            
This was implemented inside add_key_field(.. *field, *value[]...)
which assumed field to refer key Field, and value[] to refer a [low...high]
constant pair. value[0] and value[1] was then compared for equality.
            
In a 'normal' BETWEEN condition of the form '<field>  BETWEEN val1 and val2' the
BETWEEN operation is represented with an argementlist containing the
values [<field>, val1, val2] - add_key_field() is then called with
parameters field=<field>, *value=val1.
            
However, if the BETWEEN predicate specified:
            
 1)  '<const1>  BETWEEN<const2>  AND<field>
            
the 'field' and 'value' arguments to add_key_field() had to be swapped.
This was implemented by trying to cheat add_key_field() to handle it like:
            
 2) '<const1>  GE<const2>  AND<const1>  LE<field>'
            
As we didn't really replace the BETWEEN operation with 'ge' and 'le',
add_key_field() still handled it as a 'BETWEEN' and compared the (swapped)
arguments<const1>  and<const2>  for equality. If they was equal, the
condition 1) was incorrectly 'optimized' to:
            
 3) '<field>  EQ <const1>'
            
This fix moves this optimization of '<field>  BETWEEN c1 AND c1' into
add_key_fields() which then calls add_key_equal_fields() to collect 
key equality / comparison for the key fields in the BETWEEN condition.
2011-02-01 13:20:16 +01:00
Alfranio Correia
ee36bd7f46 merge mysql-5.1 (local) --> mysql-5.1 2011-01-31 10:08:58 +00:00
Alfranio Correia
8ce9b99246 BUG#59338 Inconsistency in binlog for statements that don't change any rows STATEMENT SBR
In SBR, if a statement does not fail, it is always written to the binary
log, regardless if rows are changed or not. If there is a failure, a
statement is only written to the binary log if a non-transactional (.e.g.
MyIsam) engine is updated.

INSERT ON DUPLICATE KEY UPDATE and INSERT IGNORE were not following the
rule above and were not written to the binary log, if then engine was
Innodb.

mysql-test/extra/rpl_tests/rpl_insert_duplicate.test:
  Added test case.
mysql-test/extra/rpl_tests/rpl_insert_ignore.test:
  Updated test case.
mysql-test/include/commit.inc:
  Updated test case as the calls to the binary log have changed
  for INSERT ON DUPLICATE and INSERT IGNORE.
mysql-test/r/commit_1innodb.result:
  Updated result file.
mysql-test/suite/rpl/r/rpl_insert_duplicate.result:
  Added test case.
mysql-test/suite/rpl/r/rpl_insert_ignore.result:
  Updated result file.
mysql-test/suite/rpl/t/rpl_insert_duplicate.test:
  Added test case.
mysql-test/suite/rpl/t/rpl_insert_ignore.test:
  Improved test case.
2011-01-28 12:09:15 +00:00
Sergey Vojtovich
7a3d113d9d Merge. 2011-01-28 14:51:28 +03:00
Sergey Vojtovich
e8ffaf4ae7 Merge. 2011-01-28 14:46:10 +03:00
Sandeep Doddaballapur
ec807c5fba 2011-01-27 11:37:55 +05:30
Mattias Jonsson
ec5e43da33 merge 2011-01-26 16:50:21 +01:00
Sandeep Doddaballapur
a9d18719f6 2011-01-25 12:14:28 +05:30
Mattias Jonsson
e24398ee42 Bug#59297: Can't find record in 'tablename' on update inner join
Regression introduced in bug#52455. Problem was that the
fixed function did not set the last used partition variable, resulting
in wrong partition used when storing the position of the newly
retrieved row.

Fixed by setting the last used partition in ha_partition::index_read_idx_map.
2011-01-24 13:41:44 +01:00
Michael Widenius
7057545699 Fixed some mysql-test-run failures and compile warnings/errors
Added logging of all possible fatal table errors if --log-warnings set to > 1


mysql-test/extra/rpl_tests/rpl_EE_err.test:
  Safety fix
mysql-test/extra/rpl_tests/rpl_row_basic.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/r/archive.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/r/csv.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/maria/r/maria-autozerofill.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/maria/t/maria-autozerofill.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/maria/t/maria-recover.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/parts/t/partition_recover_myisam.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/r/rpl_bug38694.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/r/rpl_idempotency.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/r/rpl_ignore_table.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/r/rpl_row_basic_11bugs.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/r/rpl_row_conflicts.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/r/rpl_temporary_errors.result:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/t/rpl_bug38694.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/t/rpl_idempotency.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/t/rpl_ignore_table.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/t/rpl_row_basic_11bugs.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/t/rpl_row_conflicts.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/suite/rpl/t/rpl_temporary_errors.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/t/archive.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
mysql-test/t/csv.test:
  Added suppression of possible error message (so that one can run test with --log-warnings=2)
sql/handler.cc:
  If running with --assert-of-crashed-table or --log-warnings > 1 then print engine error to log
sql/sql_select.cc:
  Disable not initialized warning from gcc
strings/Makefile.am:
  Fixed compiler error on Solaris 10 (duplicate strmov() function)
2011-01-20 19:08:12 +02:00
Martin Hansson
03db0de64f Bug#59173: Failure to handle DATE(TIME) values where Year, Month or Day is
ZERO
      
When dates are represented internally as strings, i.e. when a string constant
is compared to a date value, both values are converted to long integers,
ostensibly for fast comparisons. DATE typed integer values are converted to
DATETIME by multiplying by 1,000,000 (each digit pair representing hour,
minute and second, respectively). But the mechanism did not distuinguish
cached INTEGER values, already in correct format, from newly converted
strings.

Fixed by marking the INTEGER cache as being of DATETIME format.
2011-01-19 15:09:32 +01:00
Alexander Barkov
5574a2cd91 Bug#44332 my_xml_scan reads behind the end of buffer
Problem: the scanner function tested for strings "<![CDATA[" and
"-->" without checking input string boundaries, which led to valgrind's
"Conditional jump or move depends on uninitialised value(s)" error.

Fix: Adding boundary checking.

  @ mysql-test/r/xml.result
  @ mysql-test/t/xml.test
  Adding test

  @ strings/xml.c
  Adding a helper function my_xml_parser_prefix_cmp(),
  with input string boundary check.
2011-01-18 09:38:41 +03:00
Alexander Barkov
6665ca25af Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function
Introduced by the fix for bug#44766.

Problem: it's not correct to use args[0]->str_value as a buffer,
because args[0] may need this buffer for its own purposes.

Fix: adding a new class member tmp_value to use as return value.

  @ mysql-test/r/ctype_many.result
  @ mysql-test/t/ctype_many.test
  Adding tests

  @ sql/item_strfunc.cc
  Changing code into traditional style:
  use "str" as a buffer for the argument and tmp_value for the result value.

  @ sql/item_strfunc.h
  Adding tmp_value
2011-01-17 15:11:33 +03:00
Alexander Barkov
a2850a2f53 Bug#59149 valgrind warnings with "like .. escape .." function
Problem: when processing a query like:
  SELECT '' LIKE '1' ESCAPE COUNT(1);
escape_item->val_str() was never executed and the "escape" class member
stayed initialized, which led to valgrind uninitialized memory error.
      
Note, a query with some tables in "FROM" clause
returns ER_WRONG_ARGUMENTS in the same situation:

   SELECT '' LIKE '1' ESCAPE COUNT(1) FROM t1;
   ERROR 1210 (HY000): Incorrect arguments to ESCAPE

Fix: disallowing using aggregate functions in ESCAPE clause,
even if there are no tables used. There is no much use of that anyway.
2011-01-17 12:30:22 +03:00
Nirbhay Choubey
208b677637 Bug#58221 : mysqladmin --sleep=x --count=x keeps looping
When mysqldadmin is run with sleep and count options,
it goes into an infinite loop and keeps executing the
specified command.

This happened because the statement, responsible for
decrementing the count value, was missing.

Fixed by adding a statement which will decrement the
count value for each iteration.


client/mysqladmin.cc:
  Bug#58221 : mysqladmin --sleep=x --count=x keeps looping
  
  Added a condition to check and decrement the count
  value stored in nr_iterations per iteration.
mysql-test/r/mysqladmin.result:
  Added a testcase for Bug#58221.
mysql-test/t/mysqladmin.test:
  Added a testcase for Bug#58221.
2011-01-16 02:04:08 +05:30
unknown
12c6d1f355 BUG#49124 Security issue with /*!-versioned */ SQL statements on Slave
Backport to 5.0.

/*![:version:] Query Code */, where [:version:] is a sequence of 5 
digits representing the mysql server version(e.g /*!50200 ... */),
is a special comment that the query in it can be executed on those 
servers whose versions are larger than the version appearing in the 
comment. It leads to a security issue when slave's version is larger 
than master's. A malicious user can improve his privileges on slaves. 
Because slave SQL thread is running with SUPER privileges, so it can
execute queries that he/she does not have privileges on master.
      
This bug is fixed with the logic below: 
- To replace '!' with ' ' in the magic comments which are not applied on
  master. So they become common comments and will not be applied on slave.
      
- Example:
  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
   will be binlogged as
  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/
2011-01-15 13:48:16 +08:00
Nirbhay Choubey
ab2d29ec6b Bug#13618 : mysqldump --xml omits comment on table field
When mysqldump tries to dump information in xml format,
the result does not contain field level comments.

In order to retrieve various informations for a field/column,
mysqldump currently uses 'show fields from <tab>' statement.
The attributes returned by the statement lacks the information
regarding field comments.

Fixed by changing the query to one that probes I_S to retrieve
required field informations, including the field comment.


client/mysqldump.c:
  Bug#13618 : mysqldump --xml omits comment on table field.
  
  Replaced the 'show fields' command by a statement that
  queries I_S, in order to retrieve information on all the
  attributes that 'show fields' returns along-with an additional
  column_comment information.
mysql-test/r/client_xml.result:
  Result modifications for bug#13618.
mysql-test/r/mysqldump.result:
  Result modifications for bug#13618.
mysql-test/t/mysqldump.test:
  Added a testcase for bug#13618.
2011-01-14 19:50:34 +05:30
Igor Babaev
c8e56e3713 Fixed LP bug #702310 / bug #59493.
An assertion failure was triggered for a 6-way join query that uses two
join buffers.
The failure happened because every call of the function flush_cached_records()
saved and restored status of all tables before the table join_tab. It
must do it only for those of them that follow the last table that uses
a join buffer.
2011-01-14 02:05:10 -08:00
Luis Soares
06e21d5cd9 Automerge from bug branch into latest mysql-5.1. 2011-01-13 11:41:00 +00:00
Martin Hansson
716b64cdb0 Bug#58165: "my_empty_string" gets modified and causes LOAD DATA to fail and
other crashes

Some string manipulating SQL functions use a shared string object intended to
contain an immutable empty string. This object was used by the SQL function
SUBSTRING_INDEX() to return an empty string when one argument was of the wrong
datatype. If the string object was then modified by the sql function INSERT(),
undefined behavior ensued.

Fixed by instead modifying the string object representing the function's
result value whenever string manipulating SQL functions return an empty
string.

Relevant code has also been documented.
2011-01-13 08:57:15 +01:00
Bjorn Munch
a581444c05 merge from 5.1-mtr 2011-01-12 23:29:53 +01:00
Luis Soares
5e9cb07b66 BUG#59177: mysqlbinlog_row_big fails on Windows with out of memory
The test case fails with out of memory while updating a table
with several multi-megabytes sized rows. This can probably be too
exhausting for PB2 env.
      
The quick fix here is to reduce the size of the biggest
row (256MB) so that it becomes a little smaller (64MB).
2011-01-12 19:32:45 +00:00
Georgi Kodinov
7f9ce73d49 merge 2011-01-12 17:08:52 +02:00
Bjorn Munch
251869175e merge from 5.1 2011-01-12 15:20:40 +01:00
Dmitry Lenev
599457ae2c Fix for bug #58499 "DEFINER-security view selecting from
INVOKER-security view access check wrong".

When privilege checks were done for tables used from an 
INVOKER-security view which in its turn was used from 
a DEFINER-security view connection's active security
context was incorrectly used instead of security context
with privileges of the second view's creator.

This meant that users which had enough rights to access
the DEFINER-security view and as result were supposed to 
be able successfully access it were unable to do so in 
cases when they didn't have privileges on underlying tables 
of the INVOKER-security view.

This problem was caused by the fact that for INVOKER-security
views TABLE_LIST::security_ctx member for underlying tables
were set to 0 even in cases when particular view was used from 
another DEFINER-security view. This meant that when checks of
privileges on these underlying tables was done in
setup_tables_and_check_access() active connection security 
context was used instead of context corresponding to the 
creator of caller view.

This fix addresses the problem by ensuring that underlying
tables of an INVOKER-security view inherit security context
from the view and thus correct security context is used for
privilege checks on underlying tables in cases when such view 
is used from another view with DEFINER-security.

mysql-test/r/view_grant.result:
  Added coverage for various combinations of DEFINER and
  INVOKER-security views, including test for bug #58499
  "DEFINER-security view selecting from INVOKER-security
  view access check wrong".
mysql-test/t/view_grant.test:
  Added coverage for various combinations of DEFINER and
  INVOKER-security views, including test for bug #58499
  "DEFINER-security view selecting from INVOKER-security
  view access check wrong".
sql/sql_view.cc:
  When opening a non-suid view ensure that its underlying 
  tables will get the same security context as use for
  checking privileges on the view, i.e. security context
  of view invoker. This context can be different from the
  security context which is currently active for connection 
  in cases when this non-suid view is used from a view with
  suid security. Inheriting security context in such situation
  allows correctly apply privileges of creator of suid view
  in checks for tables of non-suid view (since in this 
  situation creator/definer of suid view serves as invoker
  for non-suid view).
2011-01-12 16:08:30 +03:00
Alexey Botchkov
33c78e328f Bug #57321 crashes and valgrind errors from spatial types
Item_func_spatial_collection::fix_length_and_dec didn't call parent's method, so
        the maybe_null was set to '0' after it. But in this case the result was
        just NULL, that caused wrong behaviour.

per-file comments:
  mysql-test/r/gis.result
Bug #57321 crashes and valgrind errors from spatial types 
        test result updated.

  mysql-test/t/gis.test
Bug #57321 crashes and valgrind errors from spatial types 
        test case added.
  sql/item_geofunc.h
Bug #57321 crashes and valgrind errors from spatial types 
        Item_func_geometry::fix_length_and_dec() called in
        Item_func_spatial_collection::fix_length_and_dec().
2011-01-12 17:02:41 +04:00
Oystein Grovlen
651313bf91 Bug#59211: Select Returns Different Value for min(year) Function
get_year_value() contains code to convert 2-digits year to
4-digits.  The fix for Bug#49910 added a check on the size of
the underlying field so that this conversion is not done for
YEAR(4) values. (Since otherwise one would convert invalid
YEAR(4) values to valid ones.)

The existing check does not work when Item_cache is used, since
it is not detected when the cache is based on a Field.  The
reported change in behavior is due to Bug#58030 which added
extra cached items in min/max computations.

The elegant solution would be to implement
Item_cache::real_item() to return the underlying Item.
However, some side effects are observed (change in explain
output) that indicates that such a change is not straight-
forward, and definitely not appropriate for an MRU.

Instead, a Item_cache::field() method has been added in order
to get access to the underlying field.  (This field() method
eliminates the need for Item_cache::eq_def() used in
test_if_ref(), but in order to limit the scope of this fix,
that code has been left as is.)


mysql-test/r/type_year.result:
  Added test case for Bug#59211.
mysql-test/t/type_year.test:
  Added test case for Bug#59211.
sql/item.h:
  Added function Item_cache::field() to get access to the
  underlying Field of a cached field Value.
sql/item_cmpfunc.cc:
  Also check underlying fields of Item_cache, not just Item_Field,
  when checking whether the value is of type YEAR(4) or not.
2011-01-12 10:37:15 +01:00
Martin Hansson
3c5662c195 Bug#58207: invalid memory reads when using default column value and
tmptable needed

The function DEFAULT() works by modifying the the data buffer pointers (often
referred to as 'record' or 'table record') of its argument. This modification
is done during name resolution (fix_fields().) Unfortunately, the same
modification is done when creating a temporary table, because default values
need to propagate to the new table.

Fixed by skipping the pointer modification for fields that are arguments to
the DEFAULT function.
2011-01-12 09:55:31 +01:00
Sergey Petrunya
6bc209c235 Merge BUG#675118 into maria-5.1 2011-01-12 11:30:18 +03:00
Bjorn Munch
e2b73747df Bug #59002 Please make mtr print correct file and line number when tests fail
Followup: had forgotten to update mysqltest.test due to changed output - duh!
2011-01-11 15:00:21 +01:00
Sergey Petrunya
ef62320957 BUG#675118: Elimination of a table results in an invalid execution plan
- Fix for MySQL BUG#52357 added NESTED_JOIN::is_fully_covered() which would 
  not take into account that MariaDB's table elimination could eliminate tables
  from join plan (and so, from join nest).
  Fixed the check in the function to compare post-table-elimination numbers.
2011-01-11 12:42:16 +02:00
Bjorn Munch
5376a76dea Bug #58900 query_get_value crashes when result begins with dollar sign
Generalized fix for recursive backtick
Optional arg to eval_expr telling it not to interpret
2011-01-11 10:54:42 +01:00
Michael Widenius
505c663a1e - Fixed that Aria works with HANDLER commands
- Added test case for Aria
- Tested HANDLER with HEAP (changes to HEAP code will be pushed in 5.3)
- Moved all HANDLER test to suite/handler.


mysql-test/Makefile.am:
  Added suite/handler
mysql-test/mysql-test-run.pl:
  Added suite/handler
mysql-test/r/lock_multi.result:
  Remove test that is already in handler test suite
mysql-test/suite/handler/aria.result:
  Test for HANDLER with Aria storage engine
mysql-test/suite/handler/aria.test:
  Test for HANDLER with Aria storage engine
mysql-test/suite/handler/handler.inc:
  Extended the general handler test
  Moved interface testing to 'interface.test'
mysql-test/suite/handler/init.inc:
  Common init for handler tests.
mysql-test/suite/handler/innodb.result:
  New results
mysql-test/suite/handler/innodb.test:
  Update to use new include files
mysql-test/suite/handler/interface.result:
  Test of HANDLER interface (not storage engine dependent parts)
mysql-test/suite/handler/interface.test:
  Test of HANDLER interface (not storage engine dependent parts)
mysql-test/suite/handler/myisam.result:
  New results
mysql-test/suite/handler/myisam.test:
  Update to use new include files
mysql-test/t/lock_multi.test:
  Remove test that is already in handler test suite
mysys/tree.c:
  Added missing handling of read previous (showed up in HEAP testing)
sql/handler.cc:
  Don't marka 'HA_ERR_RECORD_CHANGED' as fatal (can be used with HANDLER READ, especially with MEMORY ENGINE)
sql/handler.h:
  Added prototype for can_continue_handler_scan()
sql/sql_handler.cc:
  Re-initialize search if we switch from key to table search.
  Check if handler can continue searching between calls (via can_continue_handler_scan())
  Don't write common not fatal errors to log
storage/maria/ma_extra.c:
  Don't set index 0 as default. This forces call to ma_check_index() to set up index variables.
storage/maria/ma_ft_boolean_search.c:
  Ensure that info->last_key.keyinfo is set
storage/maria/ma_open.c:
  Don't set index 0 as default. This forces call to ma_check_index() to set up index variables.
storage/maria/ma_rkey.c:
  Trivial optimization
storage/maria/ma_rnext.c:
  Added missing code from mi_rnext.c to ensure that handler next/prev works.
storage/maria/ma_rsame.c:
  Simple optimizations
storage/maria/ma_search.c:
  Initialize info->last_key once and for all when we change keys.
storage/maria/ma_unique.c:
  Ensure that info->last_key.keyinfo is up to date.
2011-01-10 23:22:40 +02:00
Mattias Jonsson
c574a9c414 Bug#57924: crash when creating partitioned table with
multiple columns in the partition key

ndb crash if duplicate columns in the partitioning key.

Backport from mysql-5.1-telco-7.0, see bug#53354.

Changed from case sensitive field name comparision
to non case sensitive too.

mysql-test/r/partition_error.result:
  updated result
mysql-test/t/partition_error.test:
  Added test for the error in non-ndb partitioned table.
sql/sql_partition.cc:
  Added check for duplicated field names in the
  partitioning key.
2011-01-10 16:20:28 +01:00
Mattias Jonsson
2f47416678 merge 2011-01-10 12:56:27 +01:00
Georgi Kodinov
1ec2fccd6d automerge 2011-01-07 15:30:42 +02:00