1
0
mirror of https://github.com/MariaDB/server.git synced 2025-08-30 11:22:14 +03:00
Commit Graph

248 Commits

Author SHA1 Message Date
Oleksandr Byelkin
8cbb14ef5d Merge branch '10.1' into 10.2 2019-05-04 17:04:55 +02:00
Alexander Barkov
ba9f8776c2 Tests for MDEV-19359 ASAN heap-use-after-free in copy_if_not_alloced / make_sortkey
The patch for MDEV-18738 fixed this problem. Adding tests only.
2019-04-30 11:10:53 +04:00
Alexander Barkov
5fb6444a37 MDEV-18738 ASAN heap-use-after-free in copy_if_not_alloced / copy_fields
copy_if_not_alloced() did not handle situations when
"from" is a constant string pointing to a substring of "to",
so this code part freed "to" but then tried to copy its old (already freed)
content to a new buffer:

  if (to->realloc(from_length))
    return from;
  if ((to->str_length=MY_MIN(from->str_length,from_length)))
    memcpy(to->Ptr,from->Ptr,to->str_length);

Adding a new code piece that catches such constant substrings
and propery reallocs "to" to preserve its important part referenced
by "from".
2019-04-30 10:53:59 +04:00
Marko Mäkelä
031fa8f1d2 Merge 10.1 into 10.2 2019-03-22 11:15:21 +02:00
Alexander Barkov
3b98c65c4e MDEV-18881 Assertion `0' failed in make_sortkey upon SELECT with GROUP BY after LOAD DATA 2019-03-18 15:33:59 +04:00
Vicențiu Ciorbaru
45e6d0aebf Merge branch '10.1' into 10.2 2018-04-10 17:43:18 +03:00
Vicențiu Ciorbaru
4c89cff558 Merge branch '10.0' into 10.1 2018-04-07 17:11:22 +03:00
Alexander Barkov
6aff5fa27a MDEV-15619 using CONVERT() inside AES_ENCRYPT() in an UPDATE corrupts data 2018-03-26 10:33:58 +04:00
Marko Mäkelä
ece9c54e10 Merge 10.1 into 10.2 2017-12-14 08:40:01 +02:00
Marko Mäkelä
ce07d09fd3 Merge 10.0 into 10.1 2017-12-12 19:28:26 +02:00
Alexander Barkov
02e35ef5f2 MDEV-12681 Wrong VIEW results for CHAR(0xDF USING latin1) 2017-11-15 15:52:03 +04:00
Nirbhay Choubey
8b2e642aa2 MDEV-7635: Update tests to adapt to the new default sql_mode 2017-02-10 06:30:42 -05:00
Alexander Barkov
9f837c6e1a MDEV-10864 Wrong result for WHERE .. (f2=COMPRESS('test') OR f2=COMPRESS('TEST')) 2016-09-22 10:03:12 +04:00
Alexander Barkov
7e4eb990ad MDEV-10425 Assertion `collation.derivation == DERIVATION_IMPLICIT' failed in Item_func_conv_charset::fix_length_and_dec()
MDEV-10850 Wrong result for WHERE .. (f2=TO_BASE64('test') OR f2=TO_BASE64('TEST'))

Problem N1: MDEV-10425
Item_func_{md5|sha|sha2}::fix_length_and_dec() changed args[0]->collation
to force binary comparison in args[0]->eq().
It was done to treat e.g. MD5('a') and MD5('A') as different values.
It is wrong for a Item_func_xxx to modify its arguments.
Item_func_conv_charset did not expect that and crashed on assert.

Problem N2: MDEV-10850
Item_func_to_base64, Item_func_password, Item_func_hex are also case sensitive
hash functions, but they did not compare their arguments as binary.

Solution:
- Removing the code changing args[0]->collation
- Introducing Item_str_ascii_checksum_func as a common parent
  for Item_func_{md5|sha|sha2|password|hex|to_base64}
  and overriding its eq() method to compare arguments binary.
2016-09-22 07:00:10 +04:00
Alexander Barkov
b404b236a2 MDEV-9332 Bug after upgrade to 10.1.10 2016-01-27 11:42:31 +04:00
Alexander Barkov
30711c6650 MDEV-8806 Numeric CAST produce different warnings for strings literals vs functions 2015-09-25 21:33:50 +04:00
Alexander Barkov
9158212a27 MDEV-8369 Unexpected impossible WHERE for a condition on a ZEROFILL field
Disable IDENTITY_SUBST propagation for ZEROFILL columns,
as discussed with Sergei.
2015-09-11 15:41:53 +04:00
Oleksandr Byelkin
e3982cead2 MDEV-6066: Merge new defaults from 5.6 and 5.7 (defaults changed, QC can be stopped with no-zero size) 2015-09-04 10:33:56 +02:00
Sergei Golubchik
e7620ce4ce MDEV-8281 aes_decrypt crashes in block_crypt()
fix aes_decrypt of yassl to support zero-length input
2015-06-27 09:40:54 +02:00
Alexander Barkov
58eb51d1cf MDEV-6044 MySQL BUG#12735829 - SPACE() FUNCTION WARNING REFERS TO REPEAT() IN ER_WARN_ALLOWED_PACKET_OVERFLOWED
Merged from 5.6
2014-09-04 08:50:06 +04:00
Sergei Golubchik
6fb17a0601 5.5.39 merge 2014-08-07 18:06:56 +02:00
Sergei Golubchik
1c6ad62a26 mysql-5.5.39 merge
~40% bugfixed(*) applied
~40$ bugfixed reverted (incorrect or we're not buggy)
~20% bugfixed applied, despite us being not buggy
(*) only changes in the server code, e.g. not cmakefiles
2014-08-02 21:26:16 +02:00
unknown
113333d447 MDEV-6046: MySQL Bug#11766684 59851: UNINITIALISED VALUE IN ITEM_FUNC_LIKE::SELECT_OPTIMIZE WITH SUBQUERY AND 2014-06-04 13:03:55 +03:00
Sergei Golubchik
d3e2e1243b 5.5 merge 2014-05-09 12:35:11 +02:00
Alexander Barkov
31c82360e4 Merge from 5.3 2014-04-21 14:22:18 +04:00
Alexander Barkov
213f10363e MDEV-6045 MySQL Bug#11829861 - SUBSTRING_INDEX() RESULTS "OMIT" CHARACTER WHEN USED INSIDE LOWER() 2014-04-21 13:19:32 +04:00
Sergei Golubchik
5d0c01608c 5.2 merge 2014-03-16 21:03:01 +01:00
Sergei Golubchik
d7304375e5 mysql-5.1.73 merge 2014-03-15 18:24:15 +01:00
Alexander Barkov
e33582d20d Merging TO_BASE64() and FROM_BASE64() from MySQL-5.6 2013-09-23 18:58:33 +04:00
Sergei Golubchik
b838d081ad mysql-5.5.33 merge 2013-09-06 22:31:30 +02:00
Sergei Golubchik
28a9fea122 fix an old bug where dd_frm_type() could incorrectly determine the table type
for dynamic engines (because it only looked at the one-byte code, not at the full
engine name).
2013-08-28 22:16:13 +02:00
Tor Didriksen
8723f47391 merge 5.1 => 5.5 2013-07-01 15:38:16 +02:00
Tor Didriksen
977d58f614 Bug#58165: "my_empty_string" gets modified and causes LOAD DATA to fail and
Cleanup test case (left outfile in data dir)
2013-07-01 15:30:55 +02:00
Sergei Golubchik
b381cf843c mysql-5.5.31 merge 2013-05-07 13:05:09 +02:00
Sergei Golubchik
6599fd3e9c 5.3 merge 2013-03-27 10:03:28 +01:00
Sergei Golubchik
e308d7417b 5.2 merge 2013-03-26 19:09:47 +01:00
Sergei Golubchik
a4a18e0cbb MDEV-4289 Assertion `0' fails in make_sortkey with GROUP_CONCAT, MAKE_SET, GROUP BY
Item_func_make_set wasn't taking into account the first argument when
calculating maybe_null.

sql/item_strfunc.cc:
  rewrite Item_func_make_set, removing separate storage of the first argument
sql/item_strfunc.h:
  rewrite Item_func_make_set, removing separate storage of the first argument
2013-03-18 10:35:03 +01:00
unknown
ecd4bf62d4 MDEV-4272 fix.
Incorrect NULL value handling in Item_func_conv_charset fixed.
2013-03-14 19:07:20 +02:00
Sergei Golubchik
34e84c227f 5.2 merge 2013-01-28 09:12:23 +01:00
Sergei Golubchik
326d2d56fe MDEV-759 lp:998340 - Valgrind complains on simple selects containing expression DAY(FROM_UNIXTIME(-1))
check item->null_value before using the result of item->val_int()
2013-01-25 12:26:35 +01:00
Sergei Golubchik
ee9afef271 mysql-5.5.28 2012-10-16 13:04:42 +02:00
Sergei Golubchik
4933d21e5d merge with mysql-5.5.21 2012-03-09 08:06:59 +01:00
Tor Didriksen
4172d5e9a9 Bug#13359121 LARGE NUMBERS, /STRINGS/DTOA.C:662
Bug#12985021 SIMPLE QUERY WITH DECIMAL NUMBERS TAKE AN

When parsing the fractional part of a string which
is to be converted to double, we can stop after a few digits:
the extra digits will not contribute to the actual result anyways.


mysql-test/r/func_str.result:
  New tests.
mysql-test/t/func_str.test:
  New tests.
strings/dtoa.c:
  The problem was s2b() multiplying and adding hundreds-of-thousands
  of ever smaller fractions.
2012-01-25 16:11:03 +01:00
Sergei Golubchik
38e3ae155d mysql-5.5 merge 2012-01-16 20:16:35 +01:00
Sergei Golubchik
4f435bddfd 5.3 merge 2012-01-13 15:50:02 +01:00
Igor Babaev
17b4e4a194 Set new default values for the optimizer switch flags 'derived_merge'
and 'derived_with_keys'. Now they are set on by default.
2011-11-26 14:23:00 -08:00
Georgi Kodinov
e8313e13aa merge mysql-5.5->mysql-5.5-security 2011-10-12 15:07:15 +03:00
Tor Didriksen
0b706e54bb Bug#12985030 SIMPLE QUERY WITH DECIMAL NUMBERS LEAKS MEMORY
Re-write the test, to make pushbuild green.
Workaraound for broken pow() function on:
SunOS tyr40 5.10 Generic_127112-05 i86pc i386 i86pc

(dbx) where
current thread: t@1
=>[1] Item_func_pow::val_real(this = 0x238af20) (optimized), at 0xaa8d13 (line ~1980) in "item_func.cc"

(dbx) print pow(1.01, 1.0)
pow(1.01, 1) = 1.01
(dbx) print pow(1.01, 10.0)
pow(1.01, 10) = 1.1046221254112
(dbx) print pow(1.01, 100.0)
pow(1.01, 100) = 2.7048138294215
(dbx) print pow(1.01, 1000.0)
pow(1.01, 1000) = 20959.155637814
(dbx) print pow(1.01, 10000.0)
pow(1.01, 10000) = 1.635828711189e+43
(dbx) print pow(1.01, 100000.0)
pow(1.01, 100000) = Infinity
(dbx) print pow(1.01, 1000000.0)
pow(1.01, 1000000) = Infinity
(dbx) print pow(1.01, 10000000.0)
pow(1.01, 10000000) = Infinity
(dbx) print pow(1.01, 100000000.0)
pow(1.01, 100000000) = Infinity
(dbx) print pow(1.01, 1000000000.0)
pow(1.01, 1000000000) = 0.0
(dbx) print pow(1.01, 10000000000.0)
pow(1.01, 10000000000) = 0.0

(dbx) print value
value = 1.0111111111111
(dbx) print val2
val2 = 8796093022207.0

(dbx) print pow(value, val2)
pow(value, val2) = 0.0

so it seems pow(1.01, y)
returns Infinity for large y, but then starts to return 0.0 for even larger values of y.
2011-09-26 14:21:28 +02:00
Tor Didriksen
dbcdad7d4a Bug#12985030 SIMPLE QUERY WITH DECIMAL NUMBERS LEAKS MEMORY
mysql-test/r/func_str.result:
  New test cases.
mysql-test/t/func_str.test:
  New test cases.
strings/dtoa.c:
  Increasing the buffer size slightly made some queries pass without leaks.
  Adding Bfree(p51, alloc) fixed the remaining leaks.
2011-09-20 10:59:48 +02:00
Kristofer Pettersson
39175b9225 Bug11764310 - 57132: CONV FUNCTION CRASHES, NEGATIVE ARGUMENT TO MEMCPY
Failure to check the return state of a longlong2str() call
caused a crash. This could happen if a user executed the sql
function CONV() with certain parameters.

The patch fixes the issue by checking that the returned pointer
isn't NULL.
2011-09-06 09:42:14 +02:00