From 5b29f59aa8fe3f66d0f884f0e567891d5d75d7bd Mon Sep 17 00:00:00 2001
From: "monty@mysql.com" <>
Date: Wed, 27 Oct 2004 21:56:17 +0300
Subject: [PATCH] Fixed access to freed memory

---
 innobase/srv/srv0srv.c | 2 --
 sql/set_var.cc         | 2 --
 sql/sql_cache.cc       | 6 +++---
 sql/sql_insert.cc      | 6 ++++--
 4 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/innobase/srv/srv0srv.c b/innobase/srv/srv0srv.c
index 582f43fa4ec..b8d03cfab5f 100644
--- a/innobase/srv/srv0srv.c
+++ b/innobase/srv/srv0srv.c
@@ -881,8 +881,6 @@ srv_general_init(void)
 
 /*======================= InnoDB Server FIFO queue =======================*/
 
-/* Maximum allowable purge history length.  <=0 means 'infinite'. */
-ulint	srv_max_purge_lag		= 0;
 
 /*************************************************************************
 Puts an OS thread to wait if there are too many concurrent threads
diff --git a/sql/set_var.cc b/sql/set_var.cc
index d8c1ed2c975..905bffac29a 100644
--- a/sql/set_var.cc
+++ b/sql/set_var.cc
@@ -358,8 +358,6 @@ sys_var_thd_bool	sys_innodb_table_locks("innodb_table_locks",
                                                &SV::innodb_table_locks);
 sys_var_long_ptr	sys_innodb_autoextend_increment("innodb_autoextend_increment",
 							&srv_auto_extend_increment);
-sys_var_long_ptr	sys_innodb_max_purge_lag("innodb_max_purge_lag",
-							&srv_max_purge_lag);
 #endif
 
 /* Time/date/datetime formats */
diff --git a/sql/sql_cache.cc b/sql/sql_cache.cc
index be50b48d264..1bf8d179770 100644
--- a/sql/sql_cache.cc
+++ b/sql/sql_cache.cc
@@ -1037,9 +1037,9 @@ Query_cache::send_result_to_client(THD *thd, char *sql, uint query_length)
     */
     for (tmptable= thd->temporary_tables; tmptable ; tmptable= tmptable->next)
     {
-      if (tmptable->key_length - TMP_TABLE_KEY_EXTRA == table->key_len() &&
+      if (tmptable->key_length - TMP_TABLE_KEY_EXTRA == table->key_length() &&
           !memcmp(tmptable->table_cache_key, table->data(),
-                  table->key_len()))
+                  table->key_length()))
       {
         DBUG_PRINT("qcache",
                    ("Temporary table detected: '%s.%s'",
@@ -1050,7 +1050,7 @@ Query_cache::send_result_to_client(THD *thd, char *sql, uint query_length)
           temporary tables => assign following variable to make check
           faster.
         */
-        thd->safe_to_cache_query=0;
+        thd->lex->safe_to_cache_query=0;
         BLOCK_UNLOCK_RD(query_block);
         DBUG_RETURN(-1);
       }
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
index 2c48d1dca8f..648549ca3ac 100644
--- a/sql/sql_insert.cc
+++ b/sql/sql_insert.cc
@@ -1681,9 +1681,10 @@ bool select_create::send_eof()
     */
     if (!table->tmp_table)
     {
+      ulong version= table->version;
       hash_delete(&open_cache,(byte*) table);
       /* Tell threads waiting for refresh that something has happened */
-      if (table->version != refresh_version)
+      if (version != refresh_version)
         VOID(pthread_cond_broadcast(&COND_refresh));
     }
     lock=0;
@@ -1707,11 +1708,12 @@ void select_create::abort()
     enum db_type table_type=table->db_type;
     if (!table->tmp_table)
     {
+      ulong version= table->version;      
       hash_delete(&open_cache,(byte*) table);
       if (!create_info->table_existed)
         quick_rm_table(table_type, db, name);
       /* Tell threads waiting for refresh that something has happened */
-      if (table->version != refresh_version)
+      if (version != refresh_version)
         VOID(pthread_cond_broadcast(&COND_refresh));
     }
     else if (!create_info->table_existed)