1
0
mirror of https://github.com/MariaDB/server.git synced 2025-07-04 01:23:45 +03:00
Commit Graph

20681 Commits

Author SHA1 Message Date
14ea4af7eb 5.1 -> 5.5 merge 2011-07-27 12:51:55 +04:00
3050742dd9 Bug#12584302 AFTER FIX FOR #12403504: ASSERTION FAILED: DELSUM+(INT) Y/4-TEMP > 0,
The problem is that TIME_FUZZY_DATE is explicitly used for get_arg0_date()
function in Item_date_typecast::get_date method. The fix is to use real
fuzzy_date value.


mysql-test/r/func_time.result:
  test case
mysql-test/t/func_time.test:
  test case
sql/item_timefunc.cc:
  use real fuzzy_date value
2011-07-27 12:34:25 +04:00
50af230e65 Bug #12319710: INVALID MEMORY READ AND/OR CRASH IN MY_UCA_CHARCMP
WITH UTF32

The 5.5 version of the UTF32 collation was not enforcing the BMP range that 
it currently supports when comparing with LIKE. 
Fixed by backporting the checks for the BMP from trunk.
Added a named constant for the maximum character that can have a weight
in the weight table.
2011-07-22 15:54:47 +03:00
0b5b1dd197 Fix for bug #11754210 - "45777: CHECK TABLE DOESN'T
SHOW ALL PROBLEMS FOR MERGE TABLE COMPLIANCE IN 5.1".

The problem was that CHECK/REPAIR TABLE for a MERGE table which
had several children missing or in wrong engine reported only
issue with the first such table in its result-set. While in 5.0
this statement returned the whole list of problematic tables.

Ability to report problems for all children was lost during
significant refactorings of MERGE code which were done as part
of work on 5.1 and 5.5 releases.

This patch restores status quo ante refactorings by changing
code in such a way that:
1) Failure to open child table due to its absence during CHECK/
   REPAIR TABLE for a MERGE table is not reported immediately
   when its absence is discovered in open_tables(). Instead
   handling/error reporting in such a situation is postponed
   until the moment when children are attached.
2) Code performing attaching of children no longer stops when
   it encounters first problem with one of the children during
   CHECK/REPAIR TABLE. Instead it continues iteration through
   the child list until all problems caused by child absence/
   wrong engine are reported.

Note that even after this change problem with mismatch of
child/parent definition won't be reported if there is also
another child missing, but this is how it was in 5.0 as well.

mysql-test/r/merge.result:
  Added test case for bug #11754210 - "45777: CHECK TABLE DOESN'T
  SHOW ALL PROBLEMS FOR MERGE TABLE COMPLIANCE IN 5.1".
  Adjusted results of existing tests to the fact that CHECK/REPAIR
  TABLE statements now try to report problems about missing table/
  wrong engine for all underlying tables, and to the fact that
  mismatch of parent/child definitions is always reported as an
  error and not a warning.
mysql-test/t/merge.test:
  Added test case for bug #11754210 - "45777: CHECK TABLE DOESN'T
  SHOW ALL PROBLEMS FOR MERGE TABLE COMPLIANCE IN 5.1".
sql/sql_base.cc:
  Changed code responsible for opening tables to ignore the fact
  that underlying tables of a MERGE table are missing, if this
  table is opened for CHECK/REPAIR TABLE.
  The absence of underlying tables in this case is now detected and
  appropriate error is reported at the point when child tables are
  attached. At this point we can produce full list of problematic
  child tables/errors to be returned as part of CHECK/REPAIR TABLE
  result-set.
storage/myisammrg/ha_myisammrg.cc:
  Changed myisammrg_attach_children_callback() to handle new
  situation, when during CHECK/REPAIR TABLE we do not report 
  error about missing child immediately when this fact is 
  discovered during open_tables() but postpone error-reporting
  till the time when children are attached. 
  Also this callback is now responsible for pushing an error
  mentioning problematic child table to the list of errors to 
  be reported by CHECK/REPAIR TABLE statements.
  Finally, since now myrg_attach_children() no longer relies on
  return value from callback to determine the end of the children
  list, callback no longer needs to set my_errno value and can
  be simplified.
  
  Changed myrg_print_wrong_table() to always report a problem
  with child table as an error and not as a warning. This makes
  reporting for different types of issues with child tables
  more consistent and compatible with 5.0 behavior.
storage/myisammrg/myrg_open.c:
  Changed code in myrg_attach_children() not to abort on the
  first problem with a child table when attaching children to
  parent MERGE table during CHECK/REPAIR TABLE statement 
  execution. This allows CHECK/REPAIR TABLE to report problems 
  about absence/wrong engine for all underlying tables as
  part of their result-set.
2011-07-22 16:31:10 +04:00
9b6930ec10 Bug#12756017 - PROFILING: SET_THD_PROC_INFO DOES NOT NEED TO CALL DIRNAME_LENGTH EACH TIME
mysql-test/t/implicit_commit.test:
  Test fails if server is compiled with -DENABLED_PROFILING=0
sql/sql_class.cc:
  Let class PROFILING do its own handling of the input file name.
sql/sql_profile.cc:
  Store only basename of file argument.
2011-07-20 08:50:47 +02:00
e73ee41c6c WL#5710 : Enable and disable plugins (mysql_plugin)
This patch adds additional QA tests and enhances the
mysql_plugin test to include more test cases.
2011-07-19 10:35:03 -04:00
9e11249778 BUG#12707948 : mysql_plugin cannot run on Windows
Patch fixes an issue with reading basedir on Windows. It fixes how
the code interprets opt_basedir on Windows by adding the correct
path separators and quotes for paths with spaces.

BUG#12664302 : mysql_plugin cannot recognize the plugin config file

Patch fixes an issue with reading a plugin config file. It adds
more information to the error messages to ensure the user is
using the options correctly. Also deals with paths with spacs on
Windows.
2011-07-19 10:27:15 -04:00
a38fc8d47e WL#5710 : mysql_plugin - enable or disable plugins
This patch adds a new client utility that enables or disables plugin
features. The utility disables or enables a plugin using values (name,
soname, and symbols) provided via a configuration file by the same name.
For example, to ENABLE the daemon_example plugin, the utility will read
the daemon_example.ini configuration file and use the values contained to
enable or disable the plugin.
2011-07-19 10:17:58 -04:00
d72fefe986 Bug#12711164 - 61676: RESULT OF DIV WITH DECIMAL AND INTEGER DOES NOT MAKE SENSE
Truncate result of decimal division before converting to integer.


mysql-test/r/func_math.result:
  New test case.
mysql-test/t/func_math.test:
  New test case.
sql/item_func.cc:
  Item_func_int_div::val_int():
  Truncate result of decimal division before converting to integer.
2011-07-18 11:21:14 +02:00
589896d527 Bug#12368853 FORMAT() CRASHES WITH LARGE NUMBERS AFTER TRUNCATE...
mysql-test/r/type_float.result:
  New test case.
mysql-test/t/type_float.test:
  New test case.
sql/item_strfunc.cc:
  There was a buffer over/under-run when inserting decimal point into an empty string.
2011-07-18 10:27:05 +02:00
1a02a37243 Bug#12537160 ASSERTION FAILED: STOP0 <= &TO->BUF[TO->LEN] WITH LARGE NUMBER.
Turns out the DBUG_ASSERT added by fix for Bug#11792200 was overly pessimistic:
'stop0' is used in the main loop of do_div_mod, but we only dereference 'buf0'
for div operations, not for mod.


mysql-test/r/func_math.result:
  New test case.
mysql-test/t/func_math.test:
  New test case.
strings/decimal.c:
  Move DBUG_ASSERT down to where we actually dereference the loop pointer.
2011-07-18 09:47:39 +02:00
77baa0ceac automerge 5.1->security => 5.5-security 2011-07-18 09:09:58 +02:00
cdb8bb981c automerge 5.0->security => 5.1-security 2011-07-18 09:08:19 +02:00
1b18b486de Bug#12406055 post-push fix: ignore float output 2011-07-18 09:06:59 +02:00
4eaf439746 NULL merge (except for test) 5.1-security => 5.5-security 2011-07-15 14:10:04 +02:00
93915d0d50 merge 5.0-security => 5.1-security 2011-07-15 14:08:14 +02:00
cfcd49b467 Bug#12406055 BUFFER OVERFLOW OF VARIABLE 'BUFF' IN STRING::SET_REAL
The buffer was simply too small.
In 5.5 and trunk, the size is 311 + 31,
in 5.1 and below, the size is 331


client/sql_string.cc:
  Increase buffer size in String::set(double, ...)
include/m_string.h:
  Increase FLOATING_POINT_BUFFER
mysql-test/r/type_float.result:
  New test cases.
mysql-test/t/type_float.test:
  New test cases.
sql/sql_string.cc:
  Increase buffer size in String::set(double, ...)
sql/unireg.h:
  Move definition of FLOATING_POINT_BUFFER
2011-07-15 14:07:38 +02:00
28e6b4ed73 Bug#12736295 Buffer overflow for variable converted_err with
non-latin1 server error message

The problem was a one byte buffer overflow in the conversion
of a error message between character sets. Ahead of explaining
the problem further, some background information. Before an
error message is sent to the user, the message is converted
to the character set specified in the character_set_results
variable. For various reasons, this conversion might cause
the message to increase in length -- for example, if certain
characters can't be represented in the result character set.

If the final message length is greater than the maximum allowed
length of a error message (MYSQL_ERRMSG_SIZE), the message
is truncated. The message is also always null-terminated
regardless of the character set. The problem arises from this
null-termination. If a message length reached the maximum,
the terminating null character would be placed one byte past
the end of the message buffer.

The solution is to reserve the end of the message buffer for
the null character.

mysql-test/t/ctype_errors.test:
  Add test case for Bug#12736295.
sql/sql_error.cc:
  The to_end pointer was actually pointing past the end of
  the buffer. Since the message is always null terminated,
  point to_end to the last position of the buffer.
2011-07-15 08:05:30 -03:00
c09c4c3a97 Bug#12561297 : Disabled the test 2011-07-14 14:58:51 +05:30
083a316d1f Bug#11758414/Bug#50614: Default storage_engine not honored when set from within a stored procedure
When CREATE TABLE wasn't given ENGINE=... it would determine
the default ENGINE at parse-time rather than at execution
time, leading to incorrect behaviour (namely, later changes
to the default engine being ignore) when calling CREATE TABLE
from a stored procedure.

We now defer working out the default engine till execution of
CREATE TABLE.


mysql-test/r/sp_trans.result:
  results!
mysql-test/t/sp_trans.test:
  Show that CREATE TABLE (called from store routine) heeds
  any changes after CREATE SP / parse-time. Show that explicitly
  requesting an ENGINE still works.
sql/sql_parse.cc:
  If no ENGINE=... was given at parse-time, determine default
  engine at execution time of CREATE TABLE.
sql/sql_yacc.yy:
  If CREATE TABLE is not given ENGINE=..., don't bother
  figuring out the default engine during parsing; we'll
  do it at execution time instead to be aware of the
  latest updates.
2011-07-12 06:08:52 +01:00
c1911979e5 merge 5.1-security => 5.5-security 2011-07-11 11:27:52 +02:00
08ecbd5adb Bug#11765255 - 58201: VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS
We must allocate a larger ref_pointer_array. We failed to account for extra
items allocated here:
#0  find_order_in_list 
  uint el= all_fields.elements;
  all_fields.push_front(order_item); /* Add new field to field list. */
  ref_pointer_array[el]= order_item;
  order->item= ref_pointer_array + el;
#1  setup_order
#2  setup_without_group
#3  JOIN::prepare


mysql-test/r/order_by.result:
  New test case.
mysql-test/r/union.result:
  New test case.
mysql-test/t/order_by.test:
  New test case.
mysql-test/t/union.test:
  New test case.
sql/sql_lex.cc:
  find_order_in_list() may need some extra space, so multiply og_num by two.
sql/sql_union.cc:
  For UNION, the 'n_sum_items' are accumulated in the "global_parameters" select_lex.
  This number must be propagated to setup_ref_array()
  
  When preparing a 'fake_select_lex' we need to use global_parameters->order_list
  rather than fake_select_lex->order_list (see comments inside st_select_lex_unit::cleanup)
2011-07-11 11:20:19 +02:00
0dc17bc770 weave merge of mysql-5.5->mysql-5.5-security 2011-07-07 14:32:05 +03:00
c298dad7fd weave merge of mysql-5.1->mysql-5.1-security 2011-07-07 14:27:26 +03:00
af6ddeca48 Merge from mysql-5.0.94-release 2011-07-06 11:36:39 +02:00
7d605ec45f Merge from mysql-5.5.14-release 2011-07-06 01:13:50 +02:00
f6398a86dd Merge from mysql-5.1.58-release 2011-07-06 00:56:51 +02:00
027b5f1ed4 Updated/added copyright headers 2011-07-03 17:47:37 +02:00
bb3723835e Updated/added copyright headers 2011-06-30 21:27:04 +02:00
68f00a5686 Updated/added copyright headers 2011-06-30 17:37:13 +02:00
44135d4725 Updated/added copyright headers 2011-06-30 17:31:31 +02:00
8b1566aaaf Patch for Bug 12652769 - 61470: CASE OPERATOR IN STORED ROUTINE RETAINS
OLD VALUE OF INPUT PARAMETER.

The user-visible problem was that CASE-control-flow function
(not CASE-statement) misbehaved in stored routines under some
circumstances. The problem resulted in a crash or wrong data
returned. The error happened when expressions in CASE-function
were not of the same character set.

A CASE-function should return values of the same character set
for all branches. Internally, that means a new Item-instance
for the CONVERT(... USING <some charset>)-function is added
to the item tree when needed. The problem was that such changes
were not properly recorded using THD::change_item_tree(),
thus dangling pointers remain in the item tree after
THD::rollback_item_tree_changes(), which lead to undefined
behavior (i.e. crash / wrong data) for subsequent executions of
the stored routine.

This bug was introduced by a patch for Bug 11753363
(44793 - CHARACTER SETS: CASE CLAUSE, UCS2 OR UTF32, FAILURE).

The fixed function is Item_func_case::fix_length_and_dec().
New CONVERT-items are added in agg_item_set_converter(),
which calls THD::change_item_tree().

The problem was that an intermediate array was passed
to agg_item_set_converter(). Thus, THD::change_item_tree() there
was called on intermediate objects.

Note: those intermediate objects are allocated on THD's
memory root, so it's Ok to put them into "changed item lists".

The fix is to track changes on the correct objects.
2011-06-21 19:24:44 +04:00
0a07be0b2a merge 5.1-security->5.5-security 2011-06-16 13:54:16 +03:00
5cfac860bc merge mysql-5.5->mysql-5.5-security 2011-06-16 12:24:47 +03:00
bad47ac671 auto-merge of mysql-5.1->mysql-5.1-security 2011-06-16 12:21:53 +03:00
5a0e7394a5 BUG#11882110: UPDATE REPORTS ER_KEY_NOT_FOUND IF TABLE IS
UPDATED TWICE

For multi update it is not allowed to update a column
of a table if that table is accessed through multiple aliases
and either
1) the updated column is used as partitioning key
2) the updated column is part of the primary key 
   and the primary key is clustered

This check is done in unsafe_key_update().

The bug was that for case 2), it was checked whether
updated_column_number == table_share->primary_key 
However, the primary_key variable is the index number of the 
primary key, not a column number.

Prior to this bugfix, the first column was wrongly believed to be
the primary key. The columns covered by an index is found in
table->key_info[idx_number]->key_part. The bugfix is to check if
any of the columns in the keyparts of the primary key are
updated.

The user-visible effect is that for storage engines with
clustered primary key (e.g. InnoDB but not MyISAM) queries
like 
"UPDATE t1 AS A JOIN t2 AS B SET A.primkey=..."
will now error with 
"ERROR HY000: Primary key/partition key update is not allowed 
since the table is updated both as 'A' and 'B'." 
instead of 
"ERROR 1032 (HY000): Can't find record in 't1_tb'"
even if primkey is not the first column in the table. This 
was the intended behavior of bugfix 11764529.


mysql-test/r/multi_update.result:
  Add test for bug#11882110
mysql-test/r/multi_update_innodb.result:
  Add test for bug#11882110
mysql-test/t/multi_update.test:
  Add test for bug#11882110
mysql-test/t/multi_update_innodb.test:
  Add test for bug#11882110
sql/sql_update.cc:
  unsafe_key_update() wrongly checked if the primary key index
  number was the same as updated column number. Now it is checked
  whether any of the columns making up the primary key is updated.
sql/table.h:
  Fix comment on TABLE_SHARE::primary_key. Incorrect comment
  was introduced by an earlier merge conflict (as per dlenev)
2011-06-16 08:24:00 +02:00
7eddf251ba Bug#12561297 : Disable test main.mysql_embedded since it is failing on all platforms 2011-06-15 08:33:13 +05:30
34142b84c6 BUG#12561297:LIBMYSQLD/EXAMPLE/MYSQL_EMBEDDED IS ABORTING.
Issue:
When libmysqld/example/mysql_embedded is executed, it was getting abort. Its a
regression as it was working in 5.1 and failed in 5.5. Issue is there because 
remaining_argc/remaining_argv were not getting assigned correctly in 
init_embedded_server() which were being used later in init_common_variable().

Solution:
Rectified code to pass correct argc/argv to be used in init_common_variable().

libmysqld/lib_sql.cc:
  Rectified remaining_argc/remaining_argv assignment.
mysql-test/r/mysql_embedded.result:
  Result file for the test case added.
mysql-test/t/mysql_embedded.test:
  Added test case to verify libmysqld/example/mysql_embedded works.
2011-06-14 00:11:24 +05:30
775770145c merge 2011-06-13 11:57:47 +02:00
e827b51fa0 merge 2011-06-13 11:21:54 +02:00
44aa582bb3 merge 2011-06-13 11:09:56 +02:00
cd1dcf1ade Bug#12584161 - 43861: MAIN.QUERY_CACHE_28249 FAILS SPORADICALLY
This test case was failing on 5.5 and trunk for two reasons.
1) It waited for the "Waiting for table level lock" process
   state while this state was renamed "Waiting for table
   metadata lock" with the introduction of MDL in 5.5.
2) SET GLOBAL query_cache_size= 100000; gave a warning since
   query_cache_size is supposed to be multiples of 1024.

This patch fixes these two issues and re-enables the test case.
2011-06-10 11:40:57 +02:00
92eab9957d BUG#12561818 - RERUN OF STORED FUNCTION GIVES ERROR 1172:
RESULT CONSISTED OF MORE THAN ONE ROW

MySQL converts incorrect DATEs and DATETIMEs to '0000-00-00' on
insertion by default. This means that this sequence is possible:

CREATE TABLE t1(date_notnull DATE NOT NULL);
INSERT INTO t1 values (NULL);
SELECT * FROM t1;
0000-00-00

At the same time, ODBC drivers do not (or at least did not in the
90's) understand the DATE and DATETIME value '0000-00-00'. Thus,
to be able to query for the value 0000-00-00 it was decided in
MySQL 4.x (or maybe even before that) that for the special case
of DATE/DATETIME NOT NULL columns, the query "SELECT ... WHERE
date_notnull IS NULL" should return rows with date_notnull ==
'0000-00-00'. This is documented misbehavior that we do not want
to change.

The hack used to make MySQL return these rows is to convert 
"date_notnull IS NULL" to "date_notnull = 0". This is, however,
only done if the table date_notnull belongs to is not an inner
table of an outer join. The rationale for this seems to be that
if there is no join match for the row in the outer table,
null-complemented rows would otherwise not be returned because
the null-complemented DATE value is actually NULL. On the other
hand, this means that the "return rows with 0000-00-00 when the
query asks for IS NULL"-hack is not in effect for outer joins.

In this bug, we have a LEFT JOIN that does not misbehave like 
the documentation says it should. The fix is to rewrite

"date_notnull IS NULL" to "date_notnull IS NULL OR 
                           date_notnull = 0"
if dealing with an OUTER JOIN, otherwise 
"date_notnull IS NULL" to "date_notnull = 0"
as was done before.

Note:
The bug was originally reported as different result on first 
and second execution of SP. The reason was that during first
execution the query was correctly rewritten to an inner join
due to a null-rejecting predicate. On second execution the
"IS NULL" -> "= 0" rewrite was done because there was no outer
join. The real problem, though, was incorrect date/datetime 
IS NULL handling for OUTER JOINs.

mysql-test/r/type_datetime.result:
  Add test for BUG#12561818
mysql-test/t/type_datetime.test:
  Add test for BUG#12561818
sql/sql_select.cc:
  Special handling of NULL for DATE/DATETIME NOT NULL columns:
  In the case of outer join,
  "date_notnull IS NULL" 
  is now rewritten to
  "date_notnull IS NULL OR date_notnull = 0"
2011-06-10 10:22:45 +02:00
2d715ba604 Manual-merge of patch for bug#11753738 from mysql-5.1 tree. 2011-06-10 14:20:15 +07:00
1fea8c1b90 Fixed bug#11753738 (formely known as bug#45235) - 5.1 DOES NOT SUPPORT 5.0-ONLY
SYNTAX TRIGGERS IN ANY WAY

Table with triggers which were using deprecated (5.0-only) syntax became
unavailable for any DML and DDL after upgrade to 5.1 version of server.
Attempt to execute any statement on such a table resulted in parsing
error reported. Since this included DROP TRIGGER and DROP TABLE
statements (actually, the latter was allowed but was not functioning
properly for such tables) it was impossible to fix the problem without
manual operations on .TRG and .TRN files in data directory.

The problem was that failure to parse trigger body (due to 5.0-only
syntax) when opening trigger file for a table prevented the table
from being open. This made all operations on the table impossible
(except DROP TABLE which due to peculiarity in its implementation
dropped the table but left trigger files around).

This patch solves this problem by silencing error which occurs when
we parse trigger body during table open. Error message is preserved
for the future use and table is marked as having a broken trigger.
We also try to analyze parse tree to recover trigger name, which
will be needed in order to drop the broken trigger. DML statements
which invoke triggers on the table marked as having broken trigger
are prohibited and emit saved error message. The same happens for
DDL which change triggers except DROP TRIGGER and DROP TABLE which
try their best to do what was requested. Table becomes no longer
marked as having broken trigger when last such trigger is dropped.

mysql-test/r/trigger-compat.result:
  Add results for test case for bug#45235
mysql-test/t/trigger-compat.test:
  Add test case for bug#45235.
sql/sp_head.cc:
  Added protection against MEM_ROOT double restoring to
  sp_head::restore_thd_mem_root() method. Since this
  method can be sometimes called twice during parsing
  of stored routine (the first time during normal flow
  of parsing, and the second time when a syntax error
  is detected) we need to shortcut execution of the
  method to avoid damaging MEM_ROOT by the second
  consecutive call to this method.
sql/sql_trigger.cc:
  Added error handler Deprecated_trigger_syntax_handler to 
  catch non-OOM errors during parsing of trigger body.
  
  Added handling of parse errors into method 
  Table_triggers_list::check_n_load().
sql/sql_trigger.h:
  Added new members to handle broken triggers and error messages.
2011-06-10 10:52:39 +07:00
4fe2cd10c2 Auto-merge of follow-up for bug#11764334 from mysql-5.1 tree. 2011-06-10 01:08:38 +07:00
53e4a85204 Follow-up for patch of bug#11764334. 2011-06-10 01:05:10 +07:00
1be4de546e Auto-merge of patch for bug#11764334 from mysql-5.1 tree. 2011-06-10 00:07:03 +07:00
fa913a0b98 Fixed bug#11764334 (formerly bug#57156): ALTER EVENT CHANGES
THE EVENT STATUS.

Any ALTER EVENT statement on a disabled event enabled it back
(unless this ALTER EVENT statement explicitly disabled the event).

The problem was that during processing of an ALTER EVENT statement
value of status field was overwritten unconditionally even if new
value was not specified explicitly. As a consequence this field
was set to default value for status which corresponds to ENABLE.

The solution is to check if status field was explicitly specified in
ALTER EVENT statement before assigning new value to status field.

mysql-test/r/events_bugs.result:
  test's result for Bug#11764334 was added.
mysql-test/t/events_bugs.test:
  new test for Bug#11764334 was added.
sql/event_db_repository.cc:
  mysql_event_fill_row() was modified: set value for status field
  in events tables only in case if statement CREATE EVENT
  is being processed or if this value was set in ALTER EVENT
  statement.
  Event_db_repository::create_event was modified: removed redundant
  setting of status field after return from call to mysql_event_fill_row().
sql/event_parse_data.h:
  Event_parse_data structure was modified: added flag
  status_changed that is set to true if status's value
  was changed in ALTER EVENT statement.
sql/sql_yacc.yy:
  Set flag status_changed if status was set in ALTER EVENT
  statement.
2011-06-10 00:03:17 +07:00
184ecd9899 Fixed bug#11840395 (formerly known as bug#60347: THE STRING "VERSIONDATA"
SEEMS TO BE 'LEAKING' INTO THE SCHEMA NAME SPACE)
and bug#12428824 (Parser stack overflow and crash in sp_add_used_routine
with obscure query).

The first problem was that attempts to call a stored function by
its fully qualified name ended up with unwarranted error "ERROR 1305
(42000): FUNCTION someMixedCaseDb.my_function_name does not exist"
if this function belonged to a schema that had uppercase letters in
its name AND --lower_case_table_names was equal to either 1 or 2.

The second problem was that 5.5 version of MySQL server might have
crashed when a user tried to call stored function with too long name
or too long database name (i.e if a function and database name combined
occupied more than 2*3*64 bytes in utf8). This issue didn't affect
versions of server < 5.5.
 
The first problem was caused by the fact that in cases when a stored
function was called by its fully qualified name we didn't lowercase
name of its schema before performing look up of the function in
mysql.proc table even although lower_case_table_names mode was on.
As result we were unable to find this function since during its
creation we store lowercased version of schema name in the system
table in this mode and field for schema name uses binary collation.

Calls to stored functions were unaffected by this problem since for
them schema name is converted to lowercase as necessary.

The reason for the second bug was that MySQL Server didn't check length
of function name and database name before proceeding with execution of
stored function. As a consequence too long database name or function
name caused buffer overruns in places where the code assumes that their
length is within fixed limits, like mdl_key_init() in 5.5.

Again this issue didn't affect calls to stored procedures as for them
length of schema name and procedure name are properly checked.

This patch fixes both these bugs by adding calls to check_db_name()
and check_routine_name() to grammar rule which corresponds to a call
to a stored function. These functions ensure that length of database
name and function name for routine called is within standard limit.
Moreover call to check_db_name() handles conversion of database name
to lowercase if --lower_case_table_names mode is on.

Note that even although the second issue seems to be only reproducible
in 5.5 we still add code fixing it to 5.1 to be on the safe side (and
make code a bit more robust against possible future changes).

mysql-test/r/sp-error.result:
  Added testcase results for bug#12428824.
mysql-test/r/sp.result:
  Added testcase result for bug#11840395.
mysql-test/t/sp-error.test:
  Added testcase for bug#12428824.
mysql-test/t/sp.test:
  Added testcase for bug#11840395.
sql/sql_yacc.yy:
  Modified 'function_call_generic' rule to call check_db_name() and
  check_routine_name() in order to ensure that lengths of database name
  and function name are within limits. check_db_name() is also responsible
  for normalizing function's database name for lookup in cases when
  lowercase_table_names mode is on.
2011-06-09 23:30:52 +07:00