1
0
mirror of https://github.com/MariaDB/server.git synced 2025-08-08 11:22:35 +03:00
Commit Graph

1648 Commits

Author SHA1 Message Date
Evgeny Potemkin
bc43bff7ed Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
MySQL manual describes values of the YEAR(2) field type as follows:
values 00 - 69 mean 2000 - 2069 years and values 70 - 99 mean 1970 - 1999
years. MIN/MAX and comparison functions was comparing them as int values
thus producing wrong result.

Now the Arg_comparator class is extended with compare_year function which
performs correct comparison of the YEAR type.
The Item_sum_hybrid class now uses Item_cache and Arg_comparator objects to
correctly calculate its value.
To allow Arg_comparator to use func_name() function for Item_func and Item_sum
objects the func_name declaration is moved to the Item_result_field class.
A helper function is_owner_equal_func is added to the Arg_comparator class.
It checks whether the Arg_comparator object owner is the <=> function or not.
A helper function setup is added to the Item_sum_hybrid class. It sets up
cache item and comparator.

mysql-test/r/func_group.result:
  Added a test case for the bug#43668.
mysql-test/t/func_group.test:
  Added a test case for the bug#43668.
sql/item.cc:
  Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
  Now Item_cache_int returns the type of cached item.
sql/item.h:
  Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
  To allow Arg_comparator to use func_name() function for Item_func and Item_sum
  objects the func_name declaration is moved to the Item_result_field class.
sql/item_cmpfunc.cc:
  Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
  The Arg_comparator class is extended with compare_year function which
  performs correct comparison of the YEAR type.
sql/item_cmpfunc.h:
  Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
  The year_as_datetime variable is added to the Arg_comparator class.
  It's set to TRUE when YEAR value should be converted to the
  YYYY-00-00 00:00:00 format for correct YEAR-DATETIME comparison.
sql/item_geofunc.cc:
  Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
  Item_func_spatial_rel::val_int chenged to use Arg_comparator's string
  buffers.
sql/item_subselect.h:
  Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
  Added an implementation of the virtual func_name function.
sql/item_sum.cc:
  Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
  The Item_sum_hybrid class now uses Item_cache and Arg_comparator objects to
  correctly calculate its value.
  A helper function setup is added to the Item_sum_hybrid class. It sets up
  cache item and comparator.
sql/item_sum.h:
  Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
  The Item_sum_hybrid class now uses Item_cache and Arg_comparator objects to
  correctly calculate its value.
  Added an implementation of the virtual func_name function.
2009-11-17 17:06:46 +03:00
Evgeny Potemkin
726e83907c Bug#43668: Wrong comparison and MIN/MAX for YEAR(2)
MySQL manual describes values of the YEAR(2) field type as follows:
values 00 - 69 mean 2000 - 2069 years and values 70 - 99 mean 1970 - 1999
years. MIN/MAX and comparison functions was comparing them as int values
thus producing wrong result.

Now the Arg_comparator class is extended with compare_year function which
performs correct comparison of the YEAR type.
The Item_sum_hybrid class now uses Item_cache and Arg_comparator objects to
correctly calculate its value.
To allow Arg_comparator to use func_name() function for Item_func and Item_sum
objects the func_name declaration is moved to the Item_result_field class.
A helper function is_owner_equal_func is added to the Arg_comparator class.
It checks whether the Arg_comparator object owner is the <=> function or not.
A helper function setup is added to the Item_sum_hybrid class. It sets up
cache item and comparator.
2009-11-17 17:06:46 +03:00
unknown
a962160eec Merge with MySQL 5.1, with following additions:
- Moved some code from innodb_plugin to xtradb, to ensure that all tests runs
- Did changes in pbxt and maria storage engines becasue of changes in thd->query
- Reverted wrong code in sql_table.cc for how ROW_FORMAT is used.

This is a re-commit of Monty's merge to eliminate an extra commit from
MySQL-5.1.42 that was accidentally included in the merge.

This is a merge of the MySQL 5.1.41 clone-off (clone-5.1.41-build). In
case there are any extra changes done before final MySQL 5.1.41
release, these will need to be merged later before MariaDB 5.1.41
release.
2009-11-16 21:49:51 +01:00
Igor Babaev
d749c7e600 Merge 2009-11-09 18:32:39 -08:00
Alexander Nozdrin
7cd11f45be Manual merge from mysql-trunk-merge. 2009-11-06 17:20:27 +03:00
Alexander Nozdrin
2ca5b2c791 Manual merge from mysql-trunk-merge. 2009-11-06 17:20:27 +03:00
Davi Arnaut
1ca80ed19e Bug#48370: Absolutely wrong calculations with GROUP BY and decimal fields when using IF
Bug#45261: Crash, stored procedure + decimal

Revert fix for Bug#45261 due to unforeseen bugs.
2009-11-02 09:21:39 -02:00
Davi Arnaut
9a08362897 Bug#48370: Absolutely wrong calculations with GROUP BY and decimal fields when using IF
Bug#45261: Crash, stored procedure + decimal

Revert fix for Bug#45261 due to unforeseen bugs.
2009-11-02 09:21:39 -02:00
Igor Babaev
f7a75b999b The main commit of Andrey Zhakov's patch introducing vurtual(computed) columns.
The original patch has been ameliorated by Sanja and Igor.
2009-10-16 15:57:48 -07:00
unknown
6aad537a6a Merge MySQL 5.1.39 into MariaDB 5.1. 2009-10-15 23:38:29 +02:00
Mats Kindahl
d47710c8dc WL#5016: Fix header file include guards
Adding header include file guards to files that are missing such.
2009-09-23 23:32:31 +02:00
Mats Kindahl
4ad8ef0602 WL#5016: Fix header file include guards
Adding header include file guards to files that are missing such.
2009-09-23 23:32:31 +02:00
Sergey Petrunya
29f0dcb563 Merge MySQL->MariaDB
* Finished Monty and Jani's merge
* Some InnoDB tests still fail (because it's old xtradb code run against
  newer testsuite). They are expected to go after mergning with the latest
  xtradb.
2009-09-08 00:50:10 +04:00
Davi Arnaut
fc39459504 Bug#45261: Crash, stored procedure + decimal
The problem was that creating a DECIMAL column from a decimal
value could lead to a failed assertion as decimal values can
have a higher precision than those attached to a table. The
assert could be triggered by creating a table from a decimal
with a large (> 30) scale. Also, there was a problem in
calculating the number of digits in the integral and fractional
parts if both exceeded the maximum number of digits permitted
by the new decimal type.

The solution is to ensure that truncation procedure is executed
when deducing a DECIMAL column from a decimal value of higher
precision. If the integer part is equal to or bigger than the
maximum precision for the DECIMAL type (65), the integer part
is truncated to fit and the fractional becomes zero. Otherwise,
the fractional part is truncated to fit into the space left
after the integer part is copied.

This patch borrows code and ideas from Martin Hansson's patch.

mysql-test/r/type_newdecimal.result:
  Add test case result for Bug#45261. Also, update test case to
  reflect that an additive operation increases the precision of
  the resulting type by 1.
mysql-test/t/type_newdecimal.test:
  Add test case for Bug#45261
sql/field.cc:
  Added DBUG_ASSERT to ensure object's invariant is maintained.
  Implement method to create a field to hold a decimal value
  from an item.
sql/field.h:
  Explain member variable. Add method to create a new decimal field.
sql/item.cc:
  The precision should only be capped when storing the value
  on a table. Also, this makes it impossible to calculate the
  integer part if Item::decimals (the scale) is larger than the
  precision.
sql/item.h:
  Simplify calculation of integer part.
sql/item_cmpfunc.cc:
  Do not limit the precision. It will be capped later.
sql/item_func.cc:
  Use new method for allocating a new decimal field.
  Add a specialized method for retrieving the precision
  of a user variable item.
sql/item_func.h:
  Add method to return the precision of a user variable.
sql/item_sum.cc:
  Use new method for allocating a new decimal field.
sql/my_decimal.h:
  The integer part could be improperly calculated for a decimal
  with 31 digits in the fractional part.
sql/sql_select.cc:
  Use new method which truncates the integer or decimal parts
  as needed.
2009-08-24 16:47:08 -03:00
Davi Arnaut
31afccc407 Bug#45261: Crash, stored procedure + decimal
The problem was that creating a DECIMAL column from a decimal
value could lead to a failed assertion as decimal values can
have a higher precision than those attached to a table. The
assert could be triggered by creating a table from a decimal
with a large (> 30) scale. Also, there was a problem in
calculating the number of digits in the integral and fractional
parts if both exceeded the maximum number of digits permitted
by the new decimal type.

The solution is to ensure that truncation procedure is executed
when deducing a DECIMAL column from a decimal value of higher
precision. If the integer part is equal to or bigger than the
maximum precision for the DECIMAL type (65), the integer part
is truncated to fit and the fractional becomes zero. Otherwise,
the fractional part is truncated to fit into the space left
after the integer part is copied.

This patch borrows code and ideas from Martin Hansson's patch.
2009-08-24 16:47:08 -03:00
Anurag Shekhar
0ad57bef5d merging with 5.0 bugteam tree 2009-07-15 15:43:45 +05:30
Anurag Shekhar
c77b836ab8 Bug#37740 Server crashes on execute statement with full text search and
match against.


Server crashes when executing prepared statement with duplicating
MATCH() function calls in SELECT and ORDER BY expressions, e.g.:
SELECT MATCH(a) AGAINST('test') FROM t1 ORDER BY MATCH(a) AGAINST('test')

This query gets optimized by the server, so the value returned
by MATCH() from the SELECT list is reused for ORDER BY purposes.
To make this optimization server is comparing items from
SELECT and ORDER BY lists. We were getting server crash because
comparision function for MATCH() item is not intended to be called
at this point of execution.

In 5.0 and 5.1 this problem is workarounded by resetting MATCH()
item to the state as it was during PREPARE.

In 6.0 correct comparision function will be implemented and
duplicating MATCH() items from the ORDER BY list will be
optimized.

mysql-test/r/fulltext.result:
  Updated with the test case for Bug#37740
mysql-test/t/fulltext.test:
  A test case for Bug#37740.
sql/item_func.h:
  True initialization of 'table' happens in ::fix_fields(). As
  Item_func_match::eq() may be called before ::fix_fields(), it is
  expected that 'table' is initialized to 0 when it is reused.
  
  This is mostly affecting prepared statements, when the same item
  doesn't get destroyed, but rather cleaned up and reused.
2009-07-15 15:00:58 +05:30
Anurag Shekhar
064c990b12 merging with 5.0 bugteam tree 2009-07-15 15:43:45 +05:30
Anurag Shekhar
7c670fc3e1 Bug#37740 Server crashes on execute statement with full text search and
match against.


Server crashes when executing prepared statement with duplicating
MATCH() function calls in SELECT and ORDER BY expressions, e.g.:
SELECT MATCH(a) AGAINST('test') FROM t1 ORDER BY MATCH(a) AGAINST('test')

This query gets optimized by the server, so the value returned
by MATCH() from the SELECT list is reused for ORDER BY purposes.
To make this optimization server is comparing items from
SELECT and ORDER BY lists. We were getting server crash because
comparision function for MATCH() item is not intended to be called
at this point of execution.

In 5.0 and 5.1 this problem is workarounded by resetting MATCH()
item to the state as it was during PREPARE.

In 6.0 correct comparision function will be implemented and
duplicating MATCH() items from the ORDER BY list will be
optimized.
2009-07-15 15:00:58 +05:30
Alexey Kopytov
2d4df13ef2 Manual merge. 2009-07-03 14:36:04 +04:00
Alexey Kopytov
c936b6444a Manual merge. 2009-07-03 14:36:04 +04:00
Alexey Kopytov
096c12b2c4 Bug #45262: Bad effects with CREATE TABLE and DECIMAL
Using DECIMAL constants with more than 65 digits in CREATE 
TABLE ... SELECT led to bogus errors in release builds or 
assertion failures in debug builds. 
 
The problem was in inconsistency in how DECIMAL constants and 
fields are handled internally. We allow arbitrarily long 
DECIMAL constants, whereas DECIMAL(M,D) columns are limited to 
M<=65 and D<=30. my_decimal_precision_to_length() was used in 
both Item and Field code and truncated precision to 
DECIMAL_MAX_PRECISION when calculating value length without 
adjusting precision and decimals. As a result, a DECIMAL 
constant with more than 65 digits ended up having length less 
than precision or decimals which led to assertion failures. 
 
Fixed by modifying my_decimal_precision_to_length() so that 
precision is truncated to DECIMAL_MAX_PRECISION only for Field 
object which is indicated by the new 'truncate' parameter. 
 
Another inconsistency fixed by this patch is how DECIMAL 
constants and expressions are handled for CREATE ... SELECT. 
create_tmp_field_from_item() (which is used for constants) was 
changed as a part of the bugfix for bug #24907 to handle long 
DECIMAL constants gracefully. Item_func::tmp_table_field() 
(which is used for expressions) on the other hand was still 
using a simplistic approach when creating a Field_new_decimal 
from a DECIMAL expression. 

mysql-test/r/type_newdecimal.result:
  Added a test case for bug #45262.
mysql-test/t/type_newdecimal.test:
  Added a test case for bug #45262.
sql/item.cc:
  Use the new 'truncate' parameter in 
  my_decimal_precision_to_length().
sql/item_cmpfunc.cc:
  Use the new 'truncate' parameter in 
  my_decimal_precision_to_length().
sql/item_func.cc:
  1. Use the new 'truncate' parameter in 
  my_decimal_precision_to_length().
  
  2. Do not truncate decimal precision to DECIMAL_MAX_PRECISION
  for additive expressions involving long DECIMAL constants.
  
  3. Fixed an incosistency in how DECIMAL constants and 
  expressions are handled for CREATE ... SELECT.
sql/item_func.h:
  Use the new 'truncate' parameter in 
  my_decimal_precision_to_length().
sql/item_sum.cc:
  Use the new 'truncate' parameter in 
  my_decimal_precision_to_length().
sql/my_decimal.h:
  Do not truncate precision to DECIMAL_MAX_PRECISION
  when calculating length in 
  my_decimal_precision_to_length() if 'truncate' parameter
  is FALSE.
sql/sql_select.cc:
  1. Use the new 'truncate' parameter in 
  my_decimal_precision_to_length().
  
  2. Use a more correct logic when adjusting value's length.
2009-07-03 11:41:19 +04:00
Alexey Kopytov
4692566f9e Bug #45262: Bad effects with CREATE TABLE and DECIMAL
Using DECIMAL constants with more than 65 digits in CREATE 
TABLE ... SELECT led to bogus errors in release builds or 
assertion failures in debug builds. 
 
The problem was in inconsistency in how DECIMAL constants and 
fields are handled internally. We allow arbitrarily long 
DECIMAL constants, whereas DECIMAL(M,D) columns are limited to 
M<=65 and D<=30. my_decimal_precision_to_length() was used in 
both Item and Field code and truncated precision to 
DECIMAL_MAX_PRECISION when calculating value length without 
adjusting precision and decimals. As a result, a DECIMAL 
constant with more than 65 digits ended up having length less 
than precision or decimals which led to assertion failures. 
 
Fixed by modifying my_decimal_precision_to_length() so that 
precision is truncated to DECIMAL_MAX_PRECISION only for Field 
object which is indicated by the new 'truncate' parameter. 
 
Another inconsistency fixed by this patch is how DECIMAL 
constants and expressions are handled for CREATE ... SELECT. 
create_tmp_field_from_item() (which is used for constants) was 
changed as a part of the bugfix for bug #24907 to handle long 
DECIMAL constants gracefully. Item_func::tmp_table_field() 
(which is used for expressions) on the other hand was still 
using a simplistic approach when creating a Field_new_decimal 
from a DECIMAL expression.
2009-07-03 11:41:19 +04:00
Gleb Shchepa
06142cd545 Bug #42778: delete order by null global variable causes
assertion .\filesort.cc, line 797

A query with the "ORDER BY @@some_system_variable" clause,
where @@some_system_variable is NULL, causes assertion
failure in the filesort procedures.

The reason of the failure is in the value of
Item_func_get_system_var::maybe_null: it was unconditionally
set to false even if the value of a variable was NULL.


mysql-test/r/variables.result:
  Added test case for bug #42778.
mysql-test/suite/sys_vars/r/innodb_data_home_dir_basic.result:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/suite/sys_vars/r/innodb_flush_method_basic.result:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/suite/sys_vars/r/rpl_init_slave_func.result:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/suite/sys_vars/r/ssl_capath_basic.result:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/suite/sys_vars/r/ssl_cipher_basic.result:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/suite/sys_vars/t/innodb_data_home_dir_basic.test:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/suite/sys_vars/t/innodb_flush_method_basic.test:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/suite/sys_vars/t/ssl_capath_basic.test:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/suite/sys_vars/t/ssl_cipher_basic.test:
  Updated test case for bug #42778:
  system variables were NOT NULL, now they are nullable.
mysql-test/t/variables.test:
  Added test case for bug #42778.
sql/item.cc:
  Bug #42778: delete order by null global variable causes
              assertion .\filesort.cc, line 797
  
  The longlong_from_string_with_check function has been modified
  to skip unwanted warnings: now it uses the THD::no_errors
  flag to suppress warnings.
  The Item_func_get_system_var::update_null_value method
  sets the no_error flag.
sql/item_func.cc:
  Bug #42778: delete order by null global variable causes
              assertion .\filesort.cc, line 797
  
  1. The Item_func_get_system_var::fix_length_and_dec method
     has been modified to make system variables truly nullable.
  
  2. The Item_func_get_system_var::update_null_value method
     method has been overloaded with a simple wrapper (like
     Item_field::update_null_value) to suppress unwanted warnings
     from Item_func_get_system_var::val_int() calls on non-numeric
     variable values: the Item_func_get_system_var::update_null_value
     method sets and restores THD::no_errors flag for a nested
     call of the longlong_from_string_with_check function.
sql/item_func.h:
  Bug #42778: delete order by null global variable causes
              assertion .\filesort.cc, line 797
  
  The Item_func_get_system_var::update_null_value method
  method has been overloaded.
2009-05-22 01:22:46 +05:00
Gleb Shchepa
387a54fbbd Bug #42778: delete order by null global variable causes
assertion .\filesort.cc, line 797

A query with the "ORDER BY @@some_system_variable" clause,
where @@some_system_variable is NULL, causes assertion
failure in the filesort procedures.

The reason of the failure is in the value of
Item_func_get_system_var::maybe_null: it was unconditionally
set to false even if the value of a variable was NULL.
2009-05-22 01:22:46 +05:00
Gleb Shchepa
405bd2af11 Bug #44768: SIGFPE crash when selecting rand from a view containing null
The RAND(N) function where the N is a field of "constant" table
(table of single row) failed with a SIGFPE.

Evaluation of RAND(N) rely on constant status of its argument.
Current server "seeded" random value for each constant argument
only once, in the Item_func_rand::fix_fields method.
Then the server skipped a call to seed_random() in the
Item_func_rand::val_real method for such constant arguments.

However, non-constant state of an argument may be changed
after the call to fix_fields, if an argument is a field of
"constant" table. Thus, pre-initialization of random value
in the fix_fields method is too early.


Initialization of random value by seed_random() has been
removed from Item_func_rand::fix_fields method.
The Item_func_rand::val_real method has been modified to
call seed_random() on the first evaluation of this method
if an argument is a function.


mysql-test/r/func_math.result:
  Added test case for bug #44768.
mysql-test/t/func_math.test:
  Added test case for bug #44768.
sql/item_func.cc:
  Bug #44768: SIGFPE crash when selecting rand from a view containing null
  
  1. Initialization of random value by seed_random() has been
     removed from Item_func_rand::fix_fields method.
  2. The Item_func_rand::val_real method has been modified to
     call seed_random() on the first evaluation of this method
     if an argument is a function.
sql/item_func.h:
  Bug #44768: SIGFPE crash when selecting rand from a view containing null
  
  1. The Item_func_rand::first_eval has been added to trace
     the first evaluation of the val_real method.
  2. The Item_func_rand::cleanup method has been added to
     cleanup the first_eval flag.
2009-05-18 09:21:25 +05:00
Gleb Shchepa
9cc4cb0ea1 Bug #44768: SIGFPE crash when selecting rand from a view containing null
The RAND(N) function where the N is a field of "constant" table
(table of single row) failed with a SIGFPE.

Evaluation of RAND(N) rely on constant status of its argument.
Current server "seeded" random value for each constant argument
only once, in the Item_func_rand::fix_fields method.
Then the server skipped a call to seed_random() in the
Item_func_rand::val_real method for such constant arguments.

However, non-constant state of an argument may be changed
after the call to fix_fields, if an argument is a field of
"constant" table. Thus, pre-initialization of random value
in the fix_fields method is too early.


Initialization of random value by seed_random() has been
removed from Item_func_rand::fix_fields method.
The Item_func_rand::val_real method has been modified to
call seed_random() on the first evaluation of this method
if an argument is a function.
2009-05-18 09:21:25 +05:00
Ramil Kalimullin
3c08b9b1ab Manual merge. 2009-05-10 21:20:35 +05:00
Ramil Kalimullin
c754cc84c1 Manual merge. 2009-05-10 21:20:35 +05:00
Ramil Kalimullin
bd414485de Fix for bug#42009: SELECT into variable gives different results to direct SELECT
Problem: storing "SELECT ... INTO @var ..." results in variables we used val_xxx()
methods which returned results of the current row. 
So, in some cases (e.g. SELECT DISTINCT, GROUP BY or HAVING) we got data
from the first row of a new group (where we evaluate a clause) instead of
data from the last row of the previous group.

Fix: use val_xxx_result() counterparts to get proper results.


mysql-test/r/distinct.result:
  Fix for bug#42009: SELECT into variable gives different results to direct SELECT
    - results adjusted.
mysql-test/r/user_var.result:
  Fix for bug#42009: SELECT into variable gives different results to direct SELECT
    - test result.
mysql-test/t/user_var.test:
  Fix for bug#42009: SELECT into variable gives different results to direct SELECT
    - test case.
sql/item_func.cc:
  Fix for bug#42009: SELECT into variable gives different results to direct SELECT
    - Item_func_set_user_var::save_item_result() added to evaluate and store 
      an item's result into a user variable.
sql/item_func.h:
  Fix for bug#42009: SELECT into variable gives different results to direct SELECT
    - Item_func_set_user_var::save_item_result() added to evaluate and store 
      an item's result into a user variable.
sql/sql_class.cc:
  Fix for bug#42009: SELECT into variable gives different results to direct SELECT
    - use Item_func_set_user_var::save_item_result() to store results into user 
      variables.
2009-02-24 18:47:12 +04:00
Ramil Kalimullin
71943e3628 Fix for bug#42009: SELECT into variable gives different results to direct SELECT
Problem: storing "SELECT ... INTO @var ..." results in variables we used val_xxx()
methods which returned results of the current row. 
So, in some cases (e.g. SELECT DISTINCT, GROUP BY or HAVING) we got data
from the first row of a new group (where we evaluate a clause) instead of
data from the last row of the previous group.

Fix: use val_xxx_result() counterparts to get proper results.
2009-02-24 18:47:12 +04:00
Guilhem Bichot
704b4845aa merge of 5.1-main into 5.1-maria. Myisam->Maria change propagation will follow.
There were so many changes into mtr (this is the new mtr coming) that I rather
copied mtr from 6.0-main here (at least this one knows how to run Maria tests).
I also fixed suite/maria tests to be accepted by the new mtr.

mysys/thr_mutex.c:
  adding DBUG_PRINT here, so that we can locate where the warning is issued.
2009-02-12 15:08:56 +01:00
Gleb Shchepa
93991b6be9 Bug#42188: crash and/or memory corruption with user variables
in trigger

Interchangeable calls to the mysql_change_user client function
and invocations of a trigger changing some user variable caused
a memory corruption and a crash.

The mysql_change_user API call forces TDH::cleanup() on a server
that frees user variable entries.
However it didn't reset Item_func_set_user_var::entry to NULL
because Item_func_set_user_var::cleanup() was not overloaded.
So, Item_func_set_user_var::entry held a pointer to freed memory,
that caused a crash.

The Item_func_set_user_var::cleanup method has been overloaded
to cleanup the Item_func_set_user_var::entry field.


mysql-test/r/user_var.result:
  Added test case for bug #42188.
mysql-test/t/user_var.test:
  Added test case for bug #42188.
sql/item_func.cc:
  Bug#42188: crash and/or memory corruption with user variables
             in trigger
  
  The Item_func_set_user_var::cleanup method has been overloaded
  to cleanup the Item_func_set_user_var::entry field.
sql/item_func.h:
  Bug#42188: crash and/or memory corruption with user variables
             in trigger
  
  The Item_func_set_user_var::cleanup method has been overloaded
  to cleanup the Item_func_set_user_var::entry field.
2009-01-23 22:18:02 +04:00
Gleb Shchepa
33a09cdcc8 Bug#42188: crash and/or memory corruption with user variables
in trigger

Interchangeable calls to the mysql_change_user client function
and invocations of a trigger changing some user variable caused
a memory corruption and a crash.

The mysql_change_user API call forces TDH::cleanup() on a server
that frees user variable entries.
However it didn't reset Item_func_set_user_var::entry to NULL
because Item_func_set_user_var::cleanup() was not overloaded.
So, Item_func_set_user_var::entry held a pointer to freed memory,
that caused a crash.

The Item_func_set_user_var::cleanup method has been overloaded
to cleanup the Item_func_set_user_var::entry field.
2009-01-23 22:18:02 +04:00
Georgi Kodinov
4d8e73c818 merged 5.0-bugteam -> 5.1-bugteam 2009-01-16 17:38:38 +02:00
Georgi Kodinov
c34491360f merged 5.0-bugteam -> 5.1-bugteam 2009-01-16 17:38:38 +02:00
Georgi Kodinov
bdec5458ae auto merge 2009-01-16 16:48:41 +02:00
Georgi Kodinov
7fc8286257 auto merge 2009-01-16 16:48:41 +02:00
Georgi Kodinov
f97ef7a40e merged 5.1-main -> 5.1-bugteam 2009-01-05 18:10:20 +02:00
Georgi Kodinov
8c25823f94 merged 5.1-main -> 5.1-bugteam 2009-01-05 18:10:20 +02:00
Gleb Shchepa
cd42f4ba2c auto merge 5.0-bugteam --> 5.1-bugteam (bug 40761) 2008-12-12 18:19:33 +04:00
Gleb Shchepa
e1f93509e1 auto merge 5.0-bugteam --> 5.1-bugteam (bug 40761) 2008-12-12 18:19:33 +04:00
Gleb Shchepa
af5cf536bc Bug #40761: Assert on sum function on
IF(..., CAST(longtext AS UNSIGNED), signed_val)
            (was: LEFT JOIN on inline view crashes server)

Select from a LONGTEXT column wrapped with an expression
like "IF(..., CAST(longtext_column AS UNSIGNED), smth_signed)"
failed an assertion or crashed the server. IFNULL function was
affected too.

LONGTEXT column item has a maximum length of 32^2-1 bytes,
at the same time this is a maximum possible length of any
MySQL item. CAST(longtext_column AS UNSIGNED) returns some
unsigned numeric result of length 32^2-1, so the result of
IF/IFNULL function of this number and some other signed number
will have text length of (32^2-1)+1=32^2 (one byte for the
minus sign) - there is integer overflow, and the length is
equal to zero. That caused assert/crash.

CAST AS UNSIGNED function has been modified to limit maximal
length of resulting number to 67 (maximal length of DECIMAL
and two characters for minus sign and dot).


mysql-test/r/func_if.result:
  Added test case for bug #40761.
mysql-test/t/func_if.test:
  Added test case for bug #40761.
sql/item_func.h:
  Bug #40761: Assert on sum function on
              IF(..., CAST(longtext AS UNSIGNED), signed_val)
  
  CAST AS UNSIGNED function has been modified to limit maximal
  length of resulting number to 67 (maximal length of DECIMAL
  and two characters for minus sign and dot).
2008-12-12 17:16:25 +04:00
Gleb Shchepa
c1bf0475cf Bug #40761: Assert on sum function on
IF(..., CAST(longtext AS UNSIGNED), signed_val)
            (was: LEFT JOIN on inline view crashes server)

Select from a LONGTEXT column wrapped with an expression
like "IF(..., CAST(longtext_column AS UNSIGNED), smth_signed)"
failed an assertion or crashed the server. IFNULL function was
affected too.

LONGTEXT column item has a maximum length of 32^2-1 bytes,
at the same time this is a maximum possible length of any
MySQL item. CAST(longtext_column AS UNSIGNED) returns some
unsigned numeric result of length 32^2-1, so the result of
IF/IFNULL function of this number and some other signed number
will have text length of (32^2-1)+1=32^2 (one byte for the
minus sign) - there is integer overflow, and the length is
equal to zero. That caused assert/crash.

CAST AS UNSIGNED function has been modified to limit maximal
length of resulting number to 67 (maximal length of DECIMAL
and two characters for minus sign and dot).
2008-12-12 17:16:25 +04:00
Gleb Shchepa
749847686c rollback of bug #40761 fix 2008-12-12 15:13:11 +04:00
Gleb Shchepa
5772a50b7d rollback of bug #40761 fix 2008-12-12 15:13:11 +04:00
Gleb Shchepa
5ff1bcbc2a rollback of bug #40761 fix 2008-12-12 14:59:10 +04:00
Gleb Shchepa
03f9b2cea6 rollback of bug #40761 fix 2008-12-12 14:59:10 +04:00
Gleb Shchepa
a4467c9798 manual merge 5.0-bugteam -> 5.1-bugteam (bug 40761) 2008-12-12 02:04:06 +04:00
Gleb Shchepa
09219a03b9 manual merge 5.0-bugteam -> 5.1-bugteam (bug 40761) 2008-12-12 02:04:06 +04:00