1
0
mirror of https://github.com/MariaDB/server.git synced 2025-07-04 01:23:45 +03:00
Commit Graph

20681 Commits

Author SHA1 Message Date
d706f1a768 weave merge of mysql-5.1->mysql-5.1-security 2011-05-10 16:57:40 +03:00
8f79579925 Patch for Bug#12362125 (SP INOUT HANDLING IS BROKEN FOR TEXT TYPE).
Attempts to assign value to a table column from trigger by using
NEW.column_name pseudo-variable might result in garbled data.
That happened when:
  - the column had a BLOB-based type (e.g. TEXT)
    and
  - the value being assigned was retrieved from stored routine variable
    of the same type.

The problem was that BLOB values were not copied correctly in this
case. Instead of doing a copy of a real value, the value's representation
in record buffer was copied. This representation is essentially a
pointer to a buffer associated with the virtual table for routine
variables where the real value is stored. Since this buffer got
freed once trigger was left or could have changed its contents when
new value was assigned to corresponding routine variable such a shallow
copying resulted in garbled data in NEW.colum_name column.

It worked in 5.1 due to a subtle bug in create_virtual_tmp_table():
  - in 5.1 create_virtual_tmp_table() returned a table which
    had db_low_byte_first == false.
  - in 5.5 and up create_virtual_tmp_table() returns a table which
    has db_low_byte_first == true.
Actually, db_low_byte_first == false only for ISAM storage engine,
which was deprecated and removed in 5.0.

Having db_low_byte_first == false led to getting false in the
complex condition for the 2nd "if" in field_conv(), which in turn
led to copy-blob-behavior as a fall-back strategy:
  - to->table->s->db_low_byte_first was true (correct value)
  - from->table->s->db_low_byte_first was false (incorrect value)

In 5.5 and up that condition is true, which means blob-values are
not copied.
2011-05-09 12:29:23 +04:00
db4c6f56e2 Merge from mysql-5.5.12-release 2011-05-06 10:27:04 +02:00
83f19ef457 Merge from mysql-5.1.57-release 2011-05-06 10:03:02 +02:00
6875f4df30 BUG#12354268
Automerge from mysql-5.1 into mysql-5.5.
2011-05-06 00:55:44 +01:00
0efb452e5e BUG#12354268: MYSQLBINLOG --BASE64-OUTPUT=DECODE-ROWS DOES NOT
WORK WITH --START-POSITION
      
If setting --start-position to start after the FD event, mysqlbinlog
will output an error stating that it has not found an FD event.
However, its not that mysqlbinlog does not find it but rather that it
does not processes it in the regular way (i.e., it does not print it).
Given that one is using --base64-output=DECODE-ROWS then not printing
it is actually fine.
      
To fix this, we make mysqlbinlog not to complain when it has not
printed the FD event, is outputing in base64, but is decoding the
rows.
2011-05-05 23:48:15 +01:00
858cf12f89 Addendum 3 for bug #BUG#11764517 : expand secure_file_priv to the real
patch so that it can later be compared with patchs with expanded symlinks
2011-05-05 12:10:49 +03:00
6848f6c0d6 merge 5.1 => 5.5 : Bug#12329653 2011-05-05 08:13:22 +02:00
9d80d48806 auto-merge conservative fix for Bug#55436/Bug#11762799 2011-05-05 06:39:38 +01:00
e257fb3319 merge 5.0 => 5.1 : Bug#12329653 2011-05-04 17:12:45 +02:00
1cf483aa58 Bug#12329653 - EXPLAIN, UNION, PREPARED STATEMENT, CRASH, SQL_FULL_GROUP_BY
The query was re-written *after* we had tagged it with NON_AGG_FIELD_USED.
Remove the flag before continuing.


mysql-test/r/explain.result:
  Update test case for Bug#48295.
mysql-test/r/subselect.result:
  New test case.
mysql-test/t/explain.test:
  Update test case for Bug#48295.
mysql-test/t/subselect.test:
  New test case.
sql/item.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
sql/item_subselect.cc:
  Remove non_agg_field_used when we rewrite query '1 < some (...)' => '1 < max(...)'
sql/item_sum.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
sql/mysql_priv.h:
  Remove unused #defines.
sql/sql_lex.cc:
  Initialize new member variables.
sql/sql_lex.h:
  Replace full_group_by_flag with two boolean flags,
  and itroduce accessors for manipulating them.
sql/sql_select.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
2011-05-04 16:18:21 +02:00
e7dc2b0a3c Manual merge from mysql-5.1. 2011-05-04 17:22:38 +04:00
16f26d2aaf Patch for Bug#12394306: the sever may crash if mysql.event is corrupted.
The problem was that wrong structure of mysql.event was not detected and
the server continued to use wrongly-structured data.

The fix is to check the structure of mysql.event after opening before
any use. That makes operations with events more strict -- some operations
that might work before throw errors now. That seems to be Ok.

Another side-effect of the patch is that if mysql.event is corrupted,
unrelated DROP DATABASE statements issue an SQL warning about inability
to open mysql.event table.
2011-05-04 16:59:24 +04:00
2da8ba6404 merge mysql-5.1-security->mysql-5.5-security 2011-05-04 15:59:00 +03:00
b96d97fd7f merge mysql-5.0-security->mysql-5.1-security 2011-05-04 15:49:30 +03:00
3b52208fe1 Addendum to the fix for bug #11764517 : replaced an absolute path. 2011-05-04 15:47:29 +03:00
e76cd16967 Merged 5.0-security->5.1-security 2011-05-04 14:29:23 +03:00
3855512715 merge 2011-05-04 11:08:07 +02:00
01b68c5105 Bug #12375190: UPDATEXML CRASHES ON SIMPLE INPUTS
The XPATH implementation was not handling correctly the XPATH 
production #19 
(http://www.w3.org/TR/1999/REC-xpath-19991116/#node-sets),
namely

PathExpr ::= | FilterExpr '/' RelativeLocationPath
                    | FilterExpr '//' RelativeLocationPath

It was lacking context for the RelativeLocationPath and it was just 
ignoring the second slash instead of treating it as a different axis 
specifier.
Fixed the above two problems and added a test case.
2011-05-03 10:48:24 +03:00
044bf3b6b3 bug#11765667: bug#58655: ASSERTION FAILED, SERVER CRASHES WITH MYSQLD GOT SIGNAL 6
The partitioning engine checked the auto_increment column even if it was not to be written,
triggering a DBUG_ASSERT.

Fixed by checking if table->write_set for that column was set.
2011-04-29 13:00:16 +02:00
59d7516005 Bug #11764517: 57359: POSSIBLE TO CIRCUMVENT SECURE_FILE_PRIV
USING '..' ON WINDOWS

Backport of the fix to 5.0 (to be null-merged to 5.1).
Moved the test into the main test suite. 
Made mysql-test-run.pl to not use symlinks for sdtdata as the symlinks
are now properly recognized by secure_file_priv.
Made sure the paths in load_file(), LOAD DATA and SELECT .. INTO OUTFILE 
that are checked against secure_file_priv in a correct way similarly to 5.1 
by the extended is_secure_file_path() backport before the comparison.
Added an extensive test with all the variants of upper/lower case, 
slash/backslash and case sensitivity.
Added few comments to the code.
2011-04-28 12:22:41 +03:00
ae154449f1 Bug#12340997 - DATE_ADD/DATE_SUB WITH INTERVAL CRASHES IN GET_INTERVAL_VALUE()
get_interval_value() was trying to parse the input string,
looking for leading '-' while skipping whitespace.
The macro my_isspace() does not work for utf16 character set,
since my_charset_utf16_general_ci.ctype == NULL.

Solution: convert input to ASCII before parsing.


mysql-test/r/ctype_utf16.result:
  New test case.
mysql-test/t/ctype_utf16.test:
  New test case.
sql/item_timefunc.cc:
  Use val_string_ascii() rather than val_string()
  so that we can safely use my_isspace() for skipping whitespace.
2011-04-28 09:03:56 +02:00
163807cfca merge 2011-04-27 18:42:05 +02:00
401941c258 Post push fix for bug#11766249 bug#59316
Partitions can have different ref_length (position data length).
Removed DBUG_ASSERT which crashed debug builds when using
MAX_ROWS on some partitions.
2011-04-27 17:51:06 +02:00
197bef3876 5.1 -> 5.5 merge 2011-04-27 11:46:23 +04:00
a60c39a2ff Bug#11889186 60503: CRASH IN MAKE_DATE_TIME WITH DATE_FORMAT / STR_TO_DATE COMBINATION
calc_daynr() function returns negative result
if malformed date with zero year and month is used.
Attempt to calculate week day on negative value
leads to crash. The fix is return NULL for
'W', 'a', 'w' specifiers if zero year and month is used.
Additional fix for calc_daynr():
--added assertion that result can not be negative
--return 0 if zero year and month is used


mysql-test/r/func_time.result:
  test case
mysql-test/t/func_time.test:
  test case
sql-common/my_time.c:
  --added assertion that result can not be negative
  --return 0 if zero year and month is used
sql/item_timefunc.cc:
  eturn NULL for 'W', 'a', 'w' specifiers
  if zero year and month is used.
2011-04-27 11:35:57 +04:00
acabfc75f5 merge from 5.1 2011-04-26 11:52:58 +02:00
1930168448 5.1 -> 5.5 merge 2011-04-22 11:39:42 +04:00
a5e8d9029b Bug#11756928 48916: SERVER INCORRECTLY PROCESSING HAVING CLAUSES WITH AN ORDER BY CLAUSE
Before sorting HAVING condition is split into two parts,
first part is a table related condition and the rest of is
HAVING part. Extraction of HAVING part does not take into account
the fact that some of conditions might be non-const but
have 'used_tables' == 0 (independent subqueries)
and because of that these conditions are cut off by
make_cond_for_table() function.
The fix is to use (table_map) 0 instead of used_tables in
third argument for make_cond_for_table() function.
It allows to extract elements which belong to sorted
table and in addition elements which are independend
subqueries.


mysql-test/r/having.result:
  test case
mysql-test/t/having.test:
  test case
sql/sql_select.cc:
  The fix is to use (table_map) 0 instead of used_tables in
  third argument for make_cond_for_table() function.
  It allows to extract elements which belong to sorted
  table and in addition elements which are independend
  subqueries.
2011-04-22 11:20:55 +04:00
876c17aa94 5.1 -> 5.5 merge 2011-04-20 11:52:40 +04:00
90bbf9d615 Bug#11765923 58937: MANY VALGRIND ERRORS AFTER GROUPING BY RESULT OF DECIMAL COLUMN FUNCTION
Bug#11764671  57533: UNINITIALISED VALUES IN COPY_AND_CONVERT (SQL_STRING.CC) WITH CERTAIN CHA
When ROUND evaluates decimal result it uses Item::decimal
value as fraction value for the result. In some cases
Item::decimal is greater than real result fraction value
and uninitialised memory of result(decimal) buffer can be
used in further calculations. Issue is introduced by
Bug33143 fix. The fix is to remove erroneous assignment.


mysql-test/r/func_math.result:
  test case
mysql-test/t/func_math.test:
  test case
sql/item_func.cc:
  remove erroneous assignment
2011-04-20 11:39:20 +04:00
170f49102e Merge of test case for bug#11758558 - 50774 2011-04-18 10:46:17 +02:00
8dabe8aa92 Bug 11758558 - 50774: WRONG RESULTSET WHEN TIMESTAMP VALUES ARE APPENDED WITH
.0

The bug was fixed by the patch for bug number BUG 11763109 - 55779: SELECT
DOES NOT WORK PROPERLY IN MYSQL SERVER VERSION "5.1.42 SUSE MYSQL (Exact same
fix as was proposed for this bug.) Since the motivation for the two bug
reports was completely different, however, it still makes sense to push the
test case.

This patch contains only the test case.
2011-04-18 10:44:41 +02:00
70ed67e1cc Merge 5.5 2011-04-15 15:46:11 +02:00
060541c02e A patch for Bug#11763166 (55847: SHOW WARNINGS returns empty
result set when SQLEXCEPTION is active.

The problem was in a hackish THD::no_warnings_for_error attribute.
When it was set, an error was not written to Warning_info -- only
Diagnostics_area state was changed. That means, Diagnostics_area
might contain error state, which is not present in Warning_info.

The user-visible problem was that in some cases SHOW WARNINGS
returned empty result set (i.e. there were no warnings) while
the previous SQL statement failed. According to the MySQL
protocol errors must be presented in warning list.

The main idea of this patch is to remove THD::no_warnings_for_error.
There were few places where it was used:
  - sql_admin.cc, handling of REPAIR TABLE USE_FRM.
  - sql_show.cc, when calling fill_schema_table_from_frm().
  - sql_show.cc, when calling fill_table().
The fix is to either use internal-error-handlers, or to use
temporary Warning_info storing warnings, which might be ignored.

This patch is needed to fix Bug 11763162 (55843).
2011-04-15 16:02:22 +04:00
98d524599a 5.1 -> 5.5 merge 2011-04-15 12:55:21 +04:00
bba7b9ca0c Bug#11765139 58069: LOAD DATA INFILE: VALGRIND REPORTS INVALID MEMORY READS AND WRITES WITH U
Some multibyte sequences could be considered by my_mbcharlen() functions
as multibyte character but more exact my_ismbchar() does not think so.
In such a case this multibyte sequences is pushed into 'stack' buffer which
is too small to accommodate the sequence.
The fix is to allocate stack buffer in
compliance with max character length.


mysql-test/r/loaddata.result:
  test case
mysql-test/t/loaddata.test:
  test case
sql/sql_load.cc:
  allocate stack buffer in compliance with max character length.
2011-04-15 12:51:34 +04:00
9cd03942ab Merge fix for Bug#11765713 from 5.1 2011-04-15 08:54:05 +02:00
dd3d9477b2 Bug#11765713 58705: OPTIMIZER LET ENGINE DEPEND ON UNINITIALIZED VALUES CREATED BY OPT_SUM_QU
Valgrind warnings were caused by comparing index values to an un-initialized field.


mysql-test/r/subselect.result:
  New test cases.
mysql-test/t/subselect.test:
  New test cases.
sql/opt_sum.cc:
  Add thd to opt_sum_query enabling it to test for errors.
  If we have a non-nullable index, we cannot use it to match null values,
  since set_null() will be ignored, and we might compare uninitialized data.
sql/sql_select.cc:
  Add thd to opt_sum_query, enabling it to test for errors.
sql/sql_select.h:
  Add thd to opt_sum_query, enabling it to test for errors.
2011-04-14 16:35:24 +02:00
bd94bb5dd9 automerge 2011-04-14 13:34:53 +04:00
aaecb54982 5.1 -> 5.5 merge 2011-04-14 13:10:11 +04:00
a5986fa220 Bug#12352846 - TRANS_XA_START(THD*):
ASSERTION THD->TRANSACTION.XID_STATE.XID.IS_NULL()
               FAILED

The triggered assert checks that the previous XA transaction has
done proper cleanup before a new XA transaction is started.
The bug that caused it to be triggered was that XA COMMIT did not
clean up error state if XA COMMIT discovered that the current XA
transaction had to be rolled back.

This patch fixes the problem by resetting the XA error state
before XA COMMIT calls ha_rollback_trans(). This allows following
XA transactions to be started without triggering the assert.

Test case added to xa.test.
2011-04-14 10:13:28 +02:00
3abe56f31d Bug#11756242 48137: PROCEDURE ANALYSE() LEAKS MEMORY WHEN RETURNING NULL
There are two problems with ANALYSE():

1. Memory leak 
   it happens because do_select() can overwrite
   JOIN::procedure field(with zero value in our case) and
   JOIN destructor don't free the memory allocated for
   JOIN::procedure. The fix is to save original JOIN::procedure
   before do_select() call and restore it after do_select
   execution.

2. Wrong result
   If ANALYSE() procedure is used for the statement with LIMIT clause
   it could retrun empty result set. It happens because of missing 
   analyse::end_of_records() call. First end_send() function call
   returns NESTED_LOOP_QUERY_LIMIT and second call of end_send() with
   end_of_records flag enabled does not happen. The fix is to return
   NESTED_LOOP_OK from end_send() if procedure is active.


mysql-test/r/analyse.result:
  test case
mysql-test/t/analyse.test:
  test case
sql/sql_select.cc:
  --save original JOIN::procedure before do_select() call and
    restore it after do_select execution.
  --return NESTED_LOOP_OK from end_send() if procedure is active
2011-04-14 12:11:57 +04:00
e404124397 Merge from mysql-5.1-security to mysql-5.5-security
No conflicts
2011-04-13 09:59:17 +02:00
1386f1fb62 Merge from mysql-5.0-security to mysql-5.1-security
Text conflict in mysql-test/r/sp-security.result
2011-04-13 09:57:16 +02:00
005f91d219 Bug#11882603 SELECT_ACL ON ANY COLUMN IN MYSQL.PROC ALLOWS TO SEE
DEFINITION OF ANY ROUTINE.

This follow-up patch removes SHOW PROCEDURE CODE from the test
case as this command is only available on debug versions of the
server and therefore caused the test to fail on release builds.
2011-04-13 09:54:51 +02:00
c7337ef4d9 Bug#11938039 "RE-EXECUTION OF FRM-ONLY ALTER TABLE WITH RENAME
CLAUSE FAILS OR ABORTS SERVER".
 
Attempt to re-execute prepared ALTER TABLE statement which 
involves .FRM-only changes and also have RENAME clause led
to unwarranted 'Table doesn't exist' error in production
builds and assertion failure for debug builds.
 
This problem stemmed from the fact that for such ALTER TABLE
mysql_alter_table() code changed table list element for table 
to be altered when it tried to re-open table under new name. 
Since this change was not reverted back before next 
re-execution, it made this statement re-execution unsafe.
 
This fix addresses this problem by avoiding changing table list
element from the main table list in such a situation. Instead 
temporary TABLE_LIST object is used.

mysql-test/r/alter_table.result:
  Added test case for bug#11938039 "RE-EXECUTION OF FRM-ONLY
  ALTER TABLE WITH RENAME CLAUSE FAILS OR ABORTS SERVER".
mysql-test/t/alter_table.test:
  Added test case for bug#11938039 "RE-EXECUTION OF FRM-ONLY
  ALTER TABLE WITH RENAME CLAUSE FAILS OR ABORTS SERVER".
sql/sql_table.cc:
  Changed mysql_alter_table() not to modify table list element
  for the table being altered while re-opening table after
  .FRM-only changes. Doing this made .FRM-only ALTER TABLE 
  which also had RENAME clause unsafe for re-execution.
2011-04-13 10:16:40 +04:00
94cffe7218 Bug#12348348 - ASSERTION IN ROW0SEL.C LINE 3698:
TRX->CONC_STATE == 0 || TRX->CONC_STATE == 1

This bug was a different manifestation of Bug#11766752,
which was previously only fixed on mysql-trunk.

This patch backports the fix for Bug#11766752 to mysql-5.5,
which fixes the problem. The patch also adds some extra test
coverage.
2011-04-12 12:57:02 +02:00
bdefd2ad3b 5.1 -> 5.5 merge 2011-04-12 14:13:15 +04:00
7fa7a0cad9 Bug#11766270 59343: YEAR(4): INCORRECT RESULT AND VALGRIND WARNINGS WITH MIN/MAX, UNION
When we create temporary result table for UNION
incorrect max_length for YEAR field is used and
it leads to incorrect field value and incorrect
result string length as YEAR field value calculation
depends on field length.
The fix is to use underlying item max_length for
Item_sum_hybrid::max_length intialization.


mysql-test/r/func_group.result:
  test case
mysql-test/t/func_group.test:
  test case
sql/field.cc:
  added assert
sql/item_sum.cc:
  init Item_sum_hybrid::max_length with 
  use underlying item max_length for
  INT result type.
2011-04-12 14:01:33 +04:00