Commit graph

28773 commits

Author SHA1 Message Date
Kristofer Pettersson
e9d23b5a89 Bug#11764310 - 57132: CONV FUNCTION CRASHES, NEGATIVE ARGUMENT TO MEMCPY
Amendment to previous patch:
Failure in CONV() should return NULL instead of
empty set.
When compiled on Windows or Solaris the function
Item_func_conv::val_str() doesn't fail on 
longlong2str() but finds an earlier exit path
based on the attributes of the arguments.
This exit path returns NULL on failure and as a
consequence the original patch caused different
test results depending on the OS used.
2011-09-15 10:01:15 +02:00
Kristofer Pettersson
39175b9225 Bug11764310 - 57132: CONV FUNCTION CRASHES, NEGATIVE ARGUMENT TO MEMCPY
Failure to check the return state of a longlong2str() call
caused a crash. This could happen if a user executed the sql
function CONV() with certain parameters.

The patch fixes the issue by checking that the returned pointer
isn't NULL.
2011-09-06 09:42:14 +02:00
Tor Didriksen
4da845ec48 Backport from trunk of:
Bug#12532830 - SIGFPE OR ASSERTION (PRECISION <= ((9 * 9) - 8*2)) && (DEC <= 30)
2011-08-19 09:06:50 +02:00
Dmitry Shulga
644db66446 Fixed Bug#12621017 - CRASH IF A SP VARIABLE IS USED IN THE LIMIT CLAUSE OF A
SET STATEMENT.

Server built with debug asserts, without debug crashes if a user tries
to run a stored procedure that constains query with subquery that include
either LIMIT or LIMIT OFFSET clauses.

The problem was that Item::fix_fields() was not called for the items
representing LIMIT or OFFSET clauses.

The solution is to call Item::fix_fields() right before evaluation in
st_select_lex_unit::set_limit().

mysql-test/r/sp.result:
  Added testcase result for bug#12621017. Updated testcase result for
  bug 11918.
mysql-test/t/sp.test:
  Added testcase for bug#12621017. Addressed review comments for Bug 11918
  (added tests for use LIMIT at stored function).
sql/item.h:
  Addressed review comments for Bug 11918.
sql/share/errmsg-utf8.txt:
  Addressed review comments for Bug 11918.
sql/sp_head.cc:
  Addressed review comments for Bug 11918.
sql/sql_lex.cc:
  Added call fix_fields() for item just before its evaluation.
sql/sql_yacc.yy:
  Addressed review comments for Bug 11918.
2011-08-13 13:34:00 +07:00
Georgi Kodinov
4d0784eeba Bug #12818542: PAM: ADDING PASSWORD FOR AN ACCOUNT DISABLES
PAM AUTHENTICATION SETTINGS

SET PASSWORD code on a account with plugin authentication was errorneously
resetting the in-memory plugin pointer for the user back to native password 
plugin despite the fact that it was sending a warning that the command has 
no immediate effect.
Fixed by not updating the user's plugin if it's already set to a non default value.
Note that the bug affected only the in-memory cache of the user definitions.
Any restart of the server will fix the problem.
Also the salt and the password has are still stored into the user tables (just as 
it's documented now).
Test case added.
One old test case result updated  to have the correct value.
2011-08-12 15:04:05 +03:00
Ramil Kalimullin
e557d8a5fd Manual merge from mysql-5.5. 2011-08-09 12:03:29 +04:00
Marko Mäkelä
5962cadcfa Merge mysql-5.1 to mysql-5.5. 2011-08-08 12:16:15 +03:00
Marko Mäkelä
6f8a80270c Bug#12770537 I_S.TABLES.DATA_LENGTH does not show on-disk size
for compressed InnoDB tables

ha_innodb::info_low(): For calculating data_length or index_length,
use the compressed page size for compressed tables instead of UNIV_PAGE_SIZE.

rb:714 approved by Sunny Bains
2011-08-08 11:22:18 +03:00
Sergey Glukhov
53fb954dde 5.1 -> 5.5 merge 2011-08-02 11:54:35 +04:00
Sergey Glukhov
3468b55a21 Bug#11766594 59736: SELECT DISTINCT.. INCORRECT RESULT WITH DETERMINISTIC FUNCTION IN WHERE C
There is an optimization of DISTINCT in JOIN::optimize()
which depends on THD::used_tables value. Each SELECT statement
inside SP resets used_tables value(see mysql_select()) and it
leads to wrong result. The fix is to replace THD::used_tables
with LEX::used_tables.


mysql-test/r/sp.result:
  test case
mysql-test/t/sp.test:
  test case
sql/sql_base.cc:
  THD::used_tables is replaced with LEX::used_tables
sql/sql_class.cc:
  THD::used_tables is replaced with LEX::used_tables
sql/sql_class.h:
  THD::used_tables is replaced with LEX::used_tables
sql/sql_insert.cc:
  THD::used_tables is replaced with LEX::used_tables
sql/sql_lex.cc:
  THD::used_tables is replaced with LEX::used_tables
sql/sql_lex.h:
  THD::used_tables is replaced with LEX::used_tables
sql/sql_prepare.cc:
  THD::used_tables is replaced with LEX::used_tables
sql/sql_select.cc:
  THD::used_tables is replaced with LEX::used_tables
2011-08-02 11:33:45 +04:00
Sven Sandberg
8f209f3918 Updated default.experimental; now rpl tests are up to date as of 2011-07-25. 2011-07-27 12:36:33 +02:00
Sven Sandberg
58cf757f0b Updated default.experimental; now rpl tests are up to date as of 2011-07-25. 2011-07-27 12:35:44 +02:00
Sergey Glukhov
14ea4af7eb 5.1 -> 5.5 merge 2011-07-27 12:51:55 +04:00
Sergey Glukhov
3050742dd9 Bug#12584302 AFTER FIX FOR #12403504: ASSERTION FAILED: DELSUM+(INT) Y/4-TEMP > 0,
The problem is that TIME_FUZZY_DATE is explicitly used for get_arg0_date()
function in Item_date_typecast::get_date method. The fix is to use real
fuzzy_date value.


mysql-test/r/func_time.result:
  test case
mysql-test/t/func_time.test:
  test case
sql/item_timefunc.cc:
  use real fuzzy_date value
2011-07-27 12:34:25 +04:00
Georgi Kodinov
50af230e65 Bug #12319710: INVALID MEMORY READ AND/OR CRASH IN MY_UCA_CHARCMP
WITH UTF32

The 5.5 version of the UTF32 collation was not enforcing the BMP range that 
it currently supports when comparing with LIKE. 
Fixed by backporting the checks for the BMP from trunk.
Added a named constant for the maximum character that can have a weight
in the weight table.
2011-07-22 15:54:47 +03:00
Dmitry Lenev
0b5b1dd197 Fix for bug #11754210 - "45777: CHECK TABLE DOESN'T
SHOW ALL PROBLEMS FOR MERGE TABLE COMPLIANCE IN 5.1".

The problem was that CHECK/REPAIR TABLE for a MERGE table which
had several children missing or in wrong engine reported only
issue with the first such table in its result-set. While in 5.0
this statement returned the whole list of problematic tables.

Ability to report problems for all children was lost during
significant refactorings of MERGE code which were done as part
of work on 5.1 and 5.5 releases.

This patch restores status quo ante refactorings by changing
code in such a way that:
1) Failure to open child table due to its absence during CHECK/
   REPAIR TABLE for a MERGE table is not reported immediately
   when its absence is discovered in open_tables(). Instead
   handling/error reporting in such a situation is postponed
   until the moment when children are attached.
2) Code performing attaching of children no longer stops when
   it encounters first problem with one of the children during
   CHECK/REPAIR TABLE. Instead it continues iteration through
   the child list until all problems caused by child absence/
   wrong engine are reported.

Note that even after this change problem with mismatch of
child/parent definition won't be reported if there is also
another child missing, but this is how it was in 5.0 as well.

mysql-test/r/merge.result:
  Added test case for bug #11754210 - "45777: CHECK TABLE DOESN'T
  SHOW ALL PROBLEMS FOR MERGE TABLE COMPLIANCE IN 5.1".
  Adjusted results of existing tests to the fact that CHECK/REPAIR
  TABLE statements now try to report problems about missing table/
  wrong engine for all underlying tables, and to the fact that
  mismatch of parent/child definitions is always reported as an
  error and not a warning.
mysql-test/t/merge.test:
  Added test case for bug #11754210 - "45777: CHECK TABLE DOESN'T
  SHOW ALL PROBLEMS FOR MERGE TABLE COMPLIANCE IN 5.1".
sql/sql_base.cc:
  Changed code responsible for opening tables to ignore the fact
  that underlying tables of a MERGE table are missing, if this
  table is opened for CHECK/REPAIR TABLE.
  The absence of underlying tables in this case is now detected and
  appropriate error is reported at the point when child tables are
  attached. At this point we can produce full list of problematic
  child tables/errors to be returned as part of CHECK/REPAIR TABLE
  result-set.
storage/myisammrg/ha_myisammrg.cc:
  Changed myisammrg_attach_children_callback() to handle new
  situation, when during CHECK/REPAIR TABLE we do not report 
  error about missing child immediately when this fact is 
  discovered during open_tables() but postpone error-reporting
  till the time when children are attached. 
  Also this callback is now responsible for pushing an error
  mentioning problematic child table to the list of errors to 
  be reported by CHECK/REPAIR TABLE statements.
  Finally, since now myrg_attach_children() no longer relies on
  return value from callback to determine the end of the children
  list, callback no longer needs to set my_errno value and can
  be simplified.
  
  Changed myrg_print_wrong_table() to always report a problem
  with child table as an error and not as a warning. This makes
  reporting for different types of issues with child tables
  more consistent and compatible with 5.0 behavior.
storage/myisammrg/myrg_open.c:
  Changed code in myrg_attach_children() not to abort on the
  first problem with a child table when attaching children to
  parent MERGE table during CHECK/REPAIR TABLE statement 
  execution. This allows CHECK/REPAIR TABLE to report problems 
  about absence/wrong engine for all underlying tables as
  part of their result-set.
2011-07-22 16:31:10 +04:00
Anitha Gopi
39b4b14334 Fixed the bug number since Bug#11755949 was closed as duplicate of Bug#11753919 2011-07-20 22:42:47 +05:30
Alfranio Correia
c7adab802d merge mysql-5.5 (local) --> mysql-5.5 2011-07-20 10:24:14 +01:00
Tor Didriksen
9b6930ec10 Bug#12756017 - PROFILING: SET_THD_PROC_INFO DOES NOT NEED TO CALL DIRNAME_LENGTH EACH TIME
mysql-test/t/implicit_commit.test:
  Test fails if server is compiled with -DENABLED_PROFILING=0
sql/sql_class.cc:
  Let class PROFILING do its own handling of the input file name.
sql/sql_profile.cc:
  Store only basename of file argument.
2011-07-20 08:50:47 +02:00
Inaam Rana
fce189fadb Merge from 5.1 the fix for Bug 12356373 2011-07-19 10:54:59 -04:00
Alfranio Correia
e94de17f95 BUG#11809016 - NO WAY TO DISCOVER AN INSTANCE IS NO LONGER A SLAVE FOLLOWING MYSQL BUG#28796
Before BUG#28796, an empty host was used to identify that an instance was no
longer a slave. However, BUG#28796 changed this behavior and one cannot set
an empty host. Besides, a RESET SLAVE only cleans up information on the next
event to retrieve from the master, disables ssl and resets heartbeat period.
So a call to SHOW SLAVE STATUS after issuing a RESET SLAVE still returns some
valid information, such as host, port, user and password.

To fix this problem, we have introduced the command RESET SLAVE ALL that does
what a regular RESET SLAVE does and also clears host, port, user and password
information thus allowing users to identify when an instance is no longer a
slave.
2011-07-18 18:18:03 +01:00
Bjorn Munch
9d209fcd0a merge from 5.5-mtr 2011-07-18 12:21:59 +02:00
Tor Didriksen
d72fefe986 Bug#12711164 - 61676: RESULT OF DIV WITH DECIMAL AND INTEGER DOES NOT MAKE SENSE
Truncate result of decimal division before converting to integer.


mysql-test/r/func_math.result:
  New test case.
mysql-test/t/func_math.test:
  New test case.
sql/item_func.cc:
  Item_func_int_div::val_int():
  Truncate result of decimal division before converting to integer.
2011-07-18 11:21:14 +02:00
Tor Didriksen
589896d527 Bug#12368853 FORMAT() CRASHES WITH LARGE NUMBERS AFTER TRUNCATE...
mysql-test/r/type_float.result:
  New test case.
mysql-test/t/type_float.test:
  New test case.
sql/item_strfunc.cc:
  There was a buffer over/under-run when inserting decimal point into an empty string.
2011-07-18 10:27:05 +02:00
Tor Didriksen
1a02a37243 Bug#12537160 ASSERTION FAILED: STOP0 <= &TO->BUF[TO->LEN] WITH LARGE NUMBER.
Turns out the DBUG_ASSERT added by fix for Bug#11792200 was overly pessimistic:
'stop0' is used in the main loop of do_div_mod, but we only dereference 'buf0'
for div operations, not for mod.


mysql-test/r/func_math.result:
  New test case.
mysql-test/t/func_math.test:
  New test case.
strings/decimal.c:
  Move DBUG_ASSERT down to where we actually dereference the loop pointer.
2011-07-18 09:47:39 +02:00
Tor Didriksen
77baa0ceac automerge 5.1->security => 5.5-security 2011-07-18 09:09:58 +02:00
Tor Didriksen
cdb8bb981c automerge 5.0->security => 5.1-security 2011-07-18 09:08:19 +02:00
Tor Didriksen
1b18b486de Bug#12406055 post-push fix: ignore float output 2011-07-18 09:06:59 +02:00
Bjorn Munch
8176fdc27b merge from 5.5 main 2011-07-15 17:12:23 +02:00
Tor Didriksen
4eaf439746 NULL merge (except for test) 5.1-security => 5.5-security 2011-07-15 14:10:04 +02:00
Tor Didriksen
93915d0d50 merge 5.0-security => 5.1-security 2011-07-15 14:08:14 +02:00
Tor Didriksen
cfcd49b467 Bug#12406055 BUFFER OVERFLOW OF VARIABLE 'BUFF' IN STRING::SET_REAL
The buffer was simply too small.
In 5.5 and trunk, the size is 311 + 31,
in 5.1 and below, the size is 331


client/sql_string.cc:
  Increase buffer size in String::set(double, ...)
include/m_string.h:
  Increase FLOATING_POINT_BUFFER
mysql-test/r/type_float.result:
  New test cases.
mysql-test/t/type_float.test:
  New test cases.
sql/sql_string.cc:
  Increase buffer size in String::set(double, ...)
sql/unireg.h:
  Move definition of FLOATING_POINT_BUFFER
2011-07-15 14:07:38 +02:00
Davi Arnaut
28e6b4ed73 Bug#12736295 Buffer overflow for variable converted_err with
non-latin1 server error message

The problem was a one byte buffer overflow in the conversion
of a error message between character sets. Ahead of explaining
the problem further, some background information. Before an
error message is sent to the user, the message is converted
to the character set specified in the character_set_results
variable. For various reasons, this conversion might cause
the message to increase in length -- for example, if certain
characters can't be represented in the result character set.

If the final message length is greater than the maximum allowed
length of a error message (MYSQL_ERRMSG_SIZE), the message
is truncated. The message is also always null-terminated
regardless of the character set. The problem arises from this
null-termination. If a message length reached the maximum,
the terminating null character would be placed one byte past
the end of the message buffer.

The solution is to reserve the end of the message buffer for
the null character.

mysql-test/t/ctype_errors.test:
  Add test case for Bug#12736295.
sql/sql_error.cc:
  The to_end pointer was actually pointing past the end of
  the buffer. Since the message is always null terminated,
  point to_end to the last position of the buffer.
2011-07-15 08:05:30 -03:00
Luis Soares
0caa196009 BUG#11753004
Manual merge from mysql-5.1 into mysql-5.5.
2011-07-14 12:30:58 +01:00
Luis Soares
bf7d414b40 BUG#11753004: 44360: REPLICATION FAILED
The server crashes if it processes table map events that are
corrupted, especially if they map different tables to the same
identifier. This could happen, for instance, due to BUG 56226.
                  
We fix this by checking whether the table map has already been
mapped before actually applying the event. If it has been mapped
with different settings an error is raised and the slave SQL
thread stops. If it has been mapped with same settings the event
is skipped. If the table is set to be ignored by the filtering
rules, there is no change in behavior: the event is skipped and
ids are not checked.


mysql-test/suite/rpl/t/rpl_row_corruption.test:
  Added a simple test case that checks both cases:
  - multiple table maps with the same identifier
  - multiple table maps with the same identifier, but only one
    is processed (the others are filtered out)
2011-07-14 12:15:24 +01:00
Anitha Gopi
c09c4c3a97 Bug#12561297 : Disabled the test 2011-07-14 14:58:51 +05:30
Tor Didriksen
c1911979e5 merge 5.1-security => 5.5-security 2011-07-11 11:27:52 +02:00
Tor Didriksen
08ecbd5adb Bug#11765255 - 58201: VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS
We must allocate a larger ref_pointer_array. We failed to account for extra
items allocated here:
#0  find_order_in_list 
  uint el= all_fields.elements;
  all_fields.push_front(order_item); /* Add new field to field list. */
  ref_pointer_array[el]= order_item;
  order->item= ref_pointer_array + el;
#1  setup_order
#2  setup_without_group
#3  JOIN::prepare


mysql-test/r/order_by.result:
  New test case.
mysql-test/r/union.result:
  New test case.
mysql-test/t/order_by.test:
  New test case.
mysql-test/t/union.test:
  New test case.
sql/sql_lex.cc:
  find_order_in_list() may need some extra space, so multiply og_num by two.
sql/sql_union.cc:
  For UNION, the 'n_sum_items' are accumulated in the "global_parameters" select_lex.
  This number must be propagated to setup_ref_array()
  
  When preparing a 'fake_select_lex' we need to use global_parameters->order_list
  rather than fake_select_lex->order_list (see comments inside st_select_lex_unit::cleanup)
2011-07-11 11:20:19 +02:00
unknown
438d21189c Null Merge from mysql-5.1 with second fix for Bug#12637786
Bug#12637786 was fixed with rb:692 by marko.  But that fix has a remaining
bug.  It added this assert;
    ut_ad(ind_field->prefix_len);
before a section of code that assumes there is a prefix_len.  

The patch replaced code that explicitly avoided this with a check for
prefix_len.  It turns out that the purge thread can get to that assert
without a prefix_len because it does not use a row_ext_t* .
When UNIV_DEBUG is not defined, the affect of this is that the purge thread
sets the dfield->len to zero and then cannot find the entry in the index to
purge.  So secondary index entries remain unpurged.

This patch does not do the assert.  Instead, it uses
    'if (ind_field->prefix_len) {...}'
around the section of code that assumes a prefix_len.  This is the way the
patch I provided to Marko did it.

The test case is simply modified to do a sleep(10) in order to give the
purge thread a chance to run. Without the code change to row0row.c, this
modified testcase will assert if InnoDB was compiled with UNIV_DEBUG.
I tried to sleep(5), but it did not always assert.
2011-07-08 08:16:23 -05:00
unknown
6cc0f6a22b Bug#12637786 was fixed with rb:692 by marko. But that fix has a remaining
bug.  It added this assert;
    ut_ad(ind_field->prefix_len);
before a section of code that assumes there is a prefix_len.  

The patch replaced code that explicitly avoided this with a check for
prefix_len.  It turns out that the purge thread can get to that assert
without a prefix_len because it does not use a row_ext_t* .
When UNIV_DEBUG is not defined, the affect of this is that the purge thread
sets the dfield->len to zero and then cannot find the entry in the index to
purge.  So secondary index entries remain unpurged.

This patch does not do the assert.  Instead, it uses
    'if (ind_field->prefix_len) {...}'
around the section of code that assumes a prefix_len.  This is the way the
patch I provided to Marko did it.

The test case is simply modified to do a sleep(10) in order to give the
purge thread a chance to run. Without the code change to row0row.c, this
modified testcase will assert if InnoDB was compiled with UNIV_DEBUG.
I tried to sleep(5), but it did not always assert.
2011-07-07 16:29:30 -05:00
Georgi Kodinov
0dc17bc770 weave merge of mysql-5.5->mysql-5.5-security 2011-07-07 14:32:05 +03:00
Georgi Kodinov
c298dad7fd weave merge of mysql-5.1->mysql-5.1-security 2011-07-07 14:27:26 +03:00
Sunanda Menon
af6ddeca48 Merge from mysql-5.0.94-release 2011-07-06 11:36:39 +02:00
unknown
7d605ec45f Merge from mysql-5.5.14-release 2011-07-06 01:13:50 +02:00
Karen Langford
f6398a86dd Merge from mysql-5.1.58-release 2011-07-06 00:56:51 +02:00
Bjorn Munch
09d66e73fc merge from 5.5 main 2011-07-04 11:21:53 +02:00
Jon Olav Hauglid
c5a294e828 Merge from mysql-5.1 to mysql-5.5. 2011-07-04 09:48:14 +02:00
Jon Olav Hauglid
c2e8aacb3f Fix MTR broken by last push. 2011-07-04 09:33:16 +02:00
Kent Boortz
789aa8c485 Updated/added copyright headers 2011-07-04 01:25:49 +02:00
Kent Boortz
027b5f1ed4 Updated/added copyright headers 2011-07-03 17:47:37 +02:00