mariadb/mysql-test
Gleb Shchepa 80aa882497 Bug #54461: crash with longblob and union or update with subquery
Queries may crash, if
  1) the GREATEST or the LEAST function has a mixed list of
     numeric and LONGBLOB arguments and
  2) the result of such a function goes through an intermediate
     temporary table.

An Item that references a LONGBLOB field has max_length of
UINT_MAX32 == (2^32 - 1).

The current implementation of GREATEST/LEAST returns REAL
result for a mixed list of numeric and string arguments (that
contradicts with the current documentation, this contradiction
was discussed and it was decided to update the documentation).

The max_length of such a function call was calculated as a
maximum of argument max_length values (i.e. UINT_MAX32).

That max_length value of UINT_MAX32 was used as a length for
the intermediate temporary table Field_double to hold
GREATEST/LEAST function result.

The Field_double::val_str() method call on that field
allocates a String value.

Since an allocation of String reserves an additional byte
for a zero-termination, the size of String buffer was
set to (UINT_MAX32 + 1), that caused an integer overflow:
actually, an empty buffer of size 0 was allocated.

An initialization of the "first" byte of that zero-size
buffer with '\0' caused a crash.

The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.


******
Bug #54461: crash with longblob and union or update with subquery

Queries may crash, if
  1) the GREATEST or the LEAST function has a mixed list of
     numeric and LONGBLOB arguments and
  2) the result of such a function goes through an intermediate
     temporary table.

An Item that references a LONGBLOB field has max_length of
UINT_MAX32 == (2^32 - 1).

The current implementation of GREATEST/LEAST returns REAL
result for a mixed list of numeric and string arguments (that
contradicts with the current documentation, this contradiction
was discussed and it was decided to update the documentation).

The max_length of such a function call was calculated as a
maximum of argument max_length values (i.e. UINT_MAX32).

That max_length value of UINT_MAX32 was used as a length for
the intermediate temporary table Field_double to hold
GREATEST/LEAST function result.

The Field_double::val_str() method call on that field
allocates a String value.

Since an allocation of String reserves an additional byte
for a zero-termination, the size of String buffer was
set to (UINT_MAX32 + 1), that caused an integer overflow:
actually, an empty buffer of size 0 was allocated.

An initialization of the "first" byte of that zero-size
buffer with '\0' caused a crash.

The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.



mysql-test/r/func_misc.result:
  Test case for bug #54461.
  
  ******
  Test case for bug #54461.
mysql-test/t/func_misc.test:
  Test case for bug #54461.
  
  ******
  Test case for bug #54461.
sql/item_func.cc:
  Bug #54461: crash with longblob and union or update with subquery
  
  The Item_func_min_max::fix_length_and_dec() has been
  modified to calculate max_length for the REAL result like
  we do it for arithmetical operators.
  
  ******
  Bug #54461: crash with longblob and union or update with subquery
  
  The Item_func_min_max::fix_length_and_dec() has been
  modified to calculate max_length for the REAL result like
  we do it for arithmetical operators.
2010-08-01 22:12:36 +04:00
..
collections Patch for bug#52913 including all review results and changes of date format. 2010-06-03 10:31:26 +02:00
extra Postfix for BUG#49741 2010-05-28 10:57:45 +08:00
include Bug#54453: Failing assertion: trx->active_trans when renaming a 2010-07-20 14:36:15 -03:00
lib Bug#53445: Build with -Wall and fix warnings that it generates 2010-07-02 15:30:47 -03:00
r Bug #54461: crash with longblob and union or update with subquery 2010-08-01 22:12:36 +04:00
std_data Bug#50389 Using intersect does not return all rows 2010-06-21 15:09:58 +04:00
suite merge 2010-07-21 18:54:11 +03:00
t Bug #54461: crash with longblob and union or update with subquery 2010-08-01 22:12:36 +04:00
Makefile.am rko Mdkeld change, revision 3351.14.134 add innodb_plugin to mysql-test-run default suites 2010-07-07 20:34:50 +02:00
mysql-stress-test.pl Test suites for engine testing, moved from test-extra so will be available 2010-03-17 23:42:07 -07:00
mysql-test-run.pl Merge mysql-5.1-innodb -> mysql-5.1-security 2010-07-04 10:12:44 +03:00
purify.supp
README
README.gcov
README.stress
valgrind.supp Suppress bogus Valgrind warnings about buf_buddy_relocate() 2010-05-25 15:37:48 +03:00

This directory contains a test suite for the MySQL daemon. To run
the currently existing test cases, simply execute ./mysql-test-run in
this directory. It will fire up the newly built mysqld and test it.

Note that you do not have to have to do "make install", and you could
actually have a co-existing MySQL installation. The tests will not
conflict with it.

All tests must pass. If one or more of them fail on your system, please
read the following manual section for instructions on how to report the
problem:

http://dev.mysql.com/doc/mysql/en/mysql-test-suite.html

If you want to use an already running MySQL server for specific tests,
use the --extern option to mysql-test-run. Please note that in this mode,
the test suite expects you to provide the names of the tests to run.
For example, here is the command to run the "alias" and "analyze" tests
with an external server:

mysql-test-run --extern alias analyze

To match your setup, you might also need to provide --socket, --user, and
other relevant options.

With no test cases named on the command line, mysql-test-run falls back
to the normal "non-extern" behavior. The reason for this is that some
tests cannot run with an external server.


You can create your own test cases. To create a test case, create a new
file in the t subdirectory using a text editor. The file should have a .test
extension. For example:

 xemacs t/test_case_name.test

 In the file, put a set of SQL statements that create some tables,
 load test data, and run some queries to manipulate it.

 We would appreciate it if you name your test tables t1, t2, t3 ... (to not
 conflict too much with existing tables).

 Your test should begin by dropping the tables you are going to create and
 end by dropping them again.  This ensures that you can run the test over
 and over again.
 
 If you are using mysqltest commands (like result file names) in your
 test case, you should create the result file as follows:

 mysql-test-run --record test_case_name

 or

 mysqltest --record < t/test_case_name.test

 If you only have a simple test cases consisting of SQL statements and
 comments, you can create the test case in one of the following ways:

 mysql-test-run --record test_case_name

 mysql test < t/test_case_name.test > r/test_case_name.result

 mysqltest --record --record-file=r/test_case_name.result < t/test_case_name.test

 When this is done, take a look at r/test_case_name.result
 - If the result is incorrect, you have found a bug. In this case, you should
   edit the test result to the correct results so that we can verify
   that the bug is corrected in future releases.

To submit your test case, put your .test file and .result file(s) into
a tar.gz archive, add a README that explains the problem, ftp the 
archive to ftp://support.mysql.com/pub/mysql/secret/ and send a mail
to bugs@lists.mysql.com