1
0
mirror of https://github.com/MariaDB/server.git synced 2025-04-23 07:05:53 +03:00

6698 Commits

Author SHA1 Message Date
Ramil Kalimullin
edfea7d590 Fix for bug #53907: Table dump command can be abused to dump arbitrary tables.
Problem: one with SELECT privilege on some table may dump other table
performing COM_TABLE_DUMP command due to missed check of the table name.

Fix: check the table name.
2010-05-25 17:56:23 +04:00
Mattias Jonsson
42d91c688c merge 2010-05-25 15:45:01 +02:00
Mattias Jonsson
427436d4b8 merge 2010-05-25 15:45:01 +02:00
Davi Arnaut
342819f168 Bug#53908: compile failure with embedded enabled
This fixes a recently introduced regression, where a variable is
not defined for the embedded server. Although the embedded server
is not supported in 5.0, make it at least compile.
2010-05-25 10:36:48 -03:00
Davi Arnaut
5f5e23fea9 Bug#53908: compile failure with embedded enabled
This fixes a recently introduced regression, where a variable is
not defined for the embedded server. Although the embedded server
is not supported in 5.0, make it at least compile.
2010-05-25 10:36:48 -03:00
Dmitry Lenev
bee0f214fd Pre-requisite patch for bug #51263 "Deadlock between
transactional SELECT and ALTER TABLE ... REBUILD PARTITION".

The goal of this patch is to decouple type of metadata
lock acquired for table by open_tables() from type of
table-level lock to be acquired on it.

To achieve this we change approach to how we determine what
type of metadata lock should be acquired on table to be open.
Now instead of inferring it at open_tables() time from flags
and type of table-level lock we rely on that type of metadata
lock is properly set at parsing time and is not changed
further.

sql/ha_ndbcluster.cc:
  Now one needs to properly initialize table list element's
  MDL_request object before calling mysql_rm_table_part2().
sql/lock.cc:
  lock_table_names() no longer initializes table list elements'
  MDL_request objects. Now proper initialization of these
  requests is a responsibility of the caller.
sql/lock.h:
  Removed MYSQL_OPEN_TAKE_UPGRADABLE_MDL flag which became
  unnecessary. Thanks to the fact that we don't reset type of
  requests for metadata locks between re-executions we now can
  figure out that upgradable locks are requested by simply
  looking at their type which were set in the parser. As result
  this flag became redundant.
sql/mdl.h:
  Added version of new operator which simplifies allocation of
  MDL_request objects on a MEM_ROOT.
sql/sp_head.cc:
  Added comment explaining why it is OK to infer type of
  metadata lock to request from type of table-level lock
  for prelocking.
  Added enum_mdl_type argument to sp_add_to_query_tables()
  to simplify its usage in trigger implementation.
sql/sp_head.h:
  Added enum_mdl_type argument to sp_add_to_query_tables()
  to simplify its usage in trigger implementation.
sql/sql_base.cc:
  - open_table_get_mdl_lock():
    Preserve type of MDL_request for table list element which
    was set in the parser by creating MDL_request objects on
    memory root if MYSQL_OPEN_FORCE_SHARED_MDL or
    MYSQL_OPEN_FORCE_SHARED_HIGH_PRIO_MDL flag were specified.
    Thanks to this and to the fact that we no longer reset
    type of requests for metadata locks between re-executions
    we no longer need to acquire exclusive metadata lock on
    table to be created in a special way. This lock is acquired
    by code handling acquiring of upgradable locks.
    Also changed signature/calling convention for this function
    to simplify its usage.
  - Accordingly special lock strategy for table list elements
    which was used for such locks became unnecessary and was
    removed. Other strategies were renamed.
  - Since we no longer have guarantee that MDL_request object
    which were not satisfied due to lock conflict belongs to
    table list element Open_table_context class and its methods
    were extended to remember pointer to MDL_request which has
    caused problem at request_backoff_action() time and use it
    in recover_from_failed_open(). Similar approach is used
    for cases when problem from which we need to recover is
    not related to MDL but to the table itself. In this case
    we store pointer to the element of table list.
  - Changed open_tables()/open_tables_check_upgradable_mdl()/
    open_tables_acquire_upgradable_mdl() not to rely on
    MYSQL_OPEN_TAKE_UPGRADABLE_MDL flag to understand when
    upgradable metadata locks should be acquired and not to
    infer type of MDL lock from type of table-level lock.
    Instead we assume that type of MDL to be acquired was set
    in the parser (we can do this as type of MDL_request is
    no longer reset between re-executions).
sql/sql_class.h:
  Since we no longer have guarantee that MDL_request object
  which were not satisfied due to lock conflict belongs to
  table list element Open_table_context class and its methods
  were extended to remember pointer to MDL_request which has
  caused problem at request_backoff_action() time and use it
  in recover_from_failed_open(). Similar approach is used
  for cases when problem from which we need to recover is
  not related to MDL but to the table itself. In this case
  we store pointer to the element of table list.
sql/sql_db.cc:
  Now one needs to properly initialize table list element's
  MDL_request object before calling mysql_rm_table_part2()
  or mysql_rename_tables().
sql/sql_lex.cc:
  st_select_lex/st_select_lex_node::add_table_to_list() method
  now has argument which allows specify type of metadata lock
  to be requested for table list element being added.
sql/sql_lex.h:
  - st_select_lex/st_select_lex_node::add_table_to_list()
    method now has argument which specifies type of metadata
    lock to be requested for table list element being added.
    This allows to explicitly set type of MDL lock to be
    acquired for a DDL statement in parser. It is also more
    future-proof than inferring type of MDL request from type
    of table-level lock.
  - Added Yacc_state::m_mdl_type member which specifies which
    type of metadata lock should be requested for tables to be
    added to table list by a grammar rule in cases when the same
    rule is used in several statements requiring different kinds
    of metadata locks.
sql/sql_parse.cc:
  - st_select_lex::add_table_to_list() method now has argument
    which specifies type of metadata lock to be requested for
    table list element being added. This allows to explicitly
    set type of MDL lock to be acquired for a DDL statement in
    parser. It is also more future-proof than inferring type of
    MDL request from type of table-level lock.
  - EXCLUSIVE_DOWNGRADABLE_MDL lock strategy has a new name -
    OTLS_DOWNGRADE_IF_EXISTS.
  - Adjusted LOCK TABLES implementation to the fact that we no
    longer infer type of metadata lock to be acquired from table
    level lock and that type of MDL request is set at parsing.
    And thus MYSQL_OPEN_TAKE_UPGRADABLE_MDL flag became
    unnecessary.
sql/sql_prepare.cc:
  TABLE_LIST's lock strategy SHARED_MDL was renamed to OTLS_NONE
  as now it means that metadata lock should not be changed during
  call to open_table() (if it has been already acquired) and is
  also used for exclusive metadata lock.
sql/sql_show.cc:
  st_select_lex::add_table_to_list() method now has argument
  which specifies type of metadata lock to be requested for
  table list element being added.
sql/sql_table.cc:
  - Adjusted mysql_admin_table()'s code to the fact that
    open_tables() no longer determines what kind of metadata
    lock should be obtained basing on type of table-level
    lock and flags. Instead type of metadata lock for table
    to be open should be set before calling open_tables().
  - Changed mysql_alter_table() code to the facts:
    a) that now it is responsibility of caller to properly
    initalize MDL_request in table list elements before calling
    lock_table_names()
    b) and that MYSQL_OPEN_TAKE_UPGRADABLE_MDL is no longer
    necessary since type of metadata lock to be obtained
    at open_tables() time is set during parsing.
  - Changed code of mysql_recreate_table() to properly set
    type of metadata and table-level lock to be obtained
    by mysql_alter_table() which it calls.
sql/sql_trigger.cc:
  Instead of relying on MYSQL_OPEN_TAKE_UPGRADABLE_MDL flag to
  force open_tables() to take an upgradable lock we now specify
  exact type of lock to be taken when constructing table list
  element for table to be open for CREATE/DROP TRIGGER.
sql/sql_view.cc:
  We no longer use TABLE_LIST::EXCLUSIVE_MDL strategy to force
  open_tables() to take an exclusive metadata lock on view to
  be created. Instead we rely on parser setting proper type of
  metadata lock to request and open_tables() acquiring it.
  This became possible thanks to the fact that we no longer
  reset type of MDL_request between statement re-executions.
sql/sql_yacc.yy:
  Instead of inferring type of MDL_request for table to be
  open from type of table-level lock and flags passed to
  open_tables() we now explicitly specify them at parsing.
  This became possible thanks to the fact that we no longer
  reset type of MDL_request between statement re-executions.
  In future this should allow to decouple type of metadata
  lock from type of table-level lock.
  The only exception to this approach is statements implemented
  through mysql_admin_table() which re-uses same table list
  element several times with different types of table-level
  and metadata locks.
  We now also properly initialize MDL_request objects for table
  list elements which are later passed to lock_table_names()
  function.
sql/table.cc:
  Do not reset type of MDL_request between statement
  re-executions. This became unnecessesary as we no longer
  change type of MDL_request residing in table list element.
  In its turn this change allows to set type of MDL_request
  only once - at parsing time.
sql/table.h:
  Got rid of TABLE_LIST::EXCLUSIVE_MDL lock strategy.
  Now we can specify that we need to acquire exclusive lock
  on table to be processed by open_tables() through setting
  an appropriate type of MDL_request at parsing time (this
  became possible thanks to the fact that we no longer reset
  types of MDL_request's belonging to table list elements
  between statement re-execution).
  Strategy SHARED_MDL was renamed to OTLS_NONE as now it
  means that metadata lock should not be changed during call
  to open_table() (if it has been already acquired) and is
  also used for exclusive metadata lock.
  Strategy EXCLUSIVE_DOWNGRADABLE_MDL was renamed to
  OTLS_DOWNGRADE_IF_EXISTS.
2010-05-25 16:35:01 +04:00
Dmitry Lenev
a3c080be7a Pre-requisite patch for bug #51263 "Deadlock between
transactional SELECT and ALTER TABLE ... REBUILD PARTITION".

The goal of this patch is to decouple type of metadata
lock acquired for table by open_tables() from type of
table-level lock to be acquired on it.

To achieve this we change approach to how we determine what
type of metadata lock should be acquired on table to be open.
Now instead of inferring it at open_tables() time from flags
and type of table-level lock we rely on that type of metadata
lock is properly set at parsing time and is not changed
further.
2010-05-25 16:35:01 +04:00
Mattias Jonsson
7af0bbc3bc Merge of bug#51851.
Also moved HA_DATA_PARTITION from ha_partition.cc to table.h.
2010-05-24 14:51:59 +02:00
Mattias Jonsson
d7e7afd403 Merge of bug#51851.
Also moved HA_DATA_PARTITION from ha_partition.cc to table.h.
2010-05-24 14:51:59 +02:00
Alexey Kopytov
c2ebb0ac88 Bug #42064: low memory crash when importing hex strings, in
Item_hex_string::Item_hex_string

The status of memory allocation in the Lex_input_stream (called
from the Parser_state constructor) was not checked which led to
a parser crash in case of the out-of-memory error.

The solution is to introduce new init() member function in
Parser_state and Lex_input_stream so that status of memory
allocation can be returned to the caller.

mysql-test/r/error_simulation.result:
  Added a test case for bug #42064.
mysql-test/t/error_simulation.test:
  Added a test case for bug #42064.
mysys/my_alloc.c:
  Added error injection code for the regression test.
mysys/my_malloc.c:
  Added error injection code for the regression test.
mysys/safemalloc.c:
  Added error injection code for the regression test.
sql/event_data_objects.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/mysqld.cc:
  Added error injection code for the regression test.
sql/sp.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_lex.cc:
  Moved memory allocation from constructor to the separate init()
  member function.
  Added error injection code for the regression test.
sql/sql_lex.h:
  Moved memory allocation from constructor to the separate init()
  member function.
sql/sql_parse.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_partition.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_prepare.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_trigger.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_view.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures..
sql/thr_malloc.cc:
  Added error injection code for the regression test.
2010-05-21 15:23:48 +04:00
Alexey Kopytov
779e2a9686 Bug #42064: low memory crash when importing hex strings, in
Item_hex_string::Item_hex_string

The status of memory allocation in the Lex_input_stream (called
from the Parser_state constructor) was not checked which led to
a parser crash in case of the out-of-memory error.

The solution is to introduce new init() member function in
Parser_state and Lex_input_stream so that status of memory
allocation can be returned to the caller.
2010-05-21 15:23:48 +04:00
Alexander Nozdrin
dabd4a1c55 Manual merge from mysql-trunk.
Conflicts:
  - mysql-test/r/partition.result
  - mysql-test/r/variables_debug.result
  - mysql-test/t/partition.test
  - mysql-test/t/variables_debug.test
2010-05-20 16:35:28 +04:00
Alexander Nozdrin
eff442964a Manual merge from mysql-trunk.
Conflicts:
  - mysql-test/r/partition.result
  - mysql-test/r/variables_debug.result
  - mysql-test/t/partition.test
  - mysql-test/t/variables_debug.test
2010-05-20 16:35:28 +04:00
Alfranio Correia
3f8bde448c BUG#53560 CREATE TEMP./DROP TEMP. are not binglogged correctly after a failed statement
This patch fixes two problems described as follows:

1 - If there is an on-going transaction and a temporary table is created or
dropped, any failed statement that follows the "create" or "drop commands"
triggers a rollback and by consequence the slave will go out sync because
the binary log will have a wrong sequence of events.

To fix the problem, we changed the expression that evaluates when the
cache should be flushed after either the rollback of a statment or
transaction.

2 - When a "CREATE TEMPORARY TABLE SELECT * FROM" was executed the
OPTION_KEEP_LOG was not set into the thd->options. For that reason, if
the transaction had updated only transactional engines and was rolled
back at the end (.e.g due to a deadlock) the changes were not written
to the binary log, including the creation of the temporary table.
      
To fix the problem, we have set the OPTION_KEEP_LOG into the thd->options
when a "CREATE TEMPORARY TABLE SELECT * FROM" is executed.

sql/log.cc:
  Reorganized the code based on the following functions:
  
  - bool ending_trans(const THD* thd, const bool all);
  - bool trans_has_updated_non_trans_table(const THD* thd);
  - bool trans_has_no_stmt_committed(const THD* thd, const bool all);
  - bool stmt_has_updated_non_trans_table(const THD* thd);
sql/log.h:
  Added functions to organize the code in log.cc.
sql/log_event.cc:
  Removed the OPTION_KEEP_LOG since it must be used only when
  creating and dropping temporary tables.
sql/log_event_old.cc:
  Removed the OPTION_KEEP_LOG since it must be used only when
  creating and dropping temporary tables.
sql/sql_parse.cc:
  When a "CREATE TEMPORARY TABLE SELECT * FROM" was executed the
  OPTION_KEEP_LOG was not set into the thd->options.
        
  To fix the problem, we have set the OPTION_KEEP_LOG into the
  thd->options when a "CREATE TEMPORARY TABLE SELECT * FROM"
  is executed.
2010-05-19 18:01:12 +01:00
Alfranio Correia
89850be0f5 BUG#53560 CREATE TEMP./DROP TEMP. are not binglogged correctly after a failed statement
This patch fixes two problems described as follows:

1 - If there is an on-going transaction and a temporary table is created or
dropped, any failed statement that follows the "create" or "drop commands"
triggers a rollback and by consequence the slave will go out sync because
the binary log will have a wrong sequence of events.

To fix the problem, we changed the expression that evaluates when the
cache should be flushed after either the rollback of a statment or
transaction.

2 - When a "CREATE TEMPORARY TABLE SELECT * FROM" was executed the
OPTION_KEEP_LOG was not set into the thd->options. For that reason, if
the transaction had updated only transactional engines and was rolled
back at the end (.e.g due to a deadlock) the changes were not written
to the binary log, including the creation of the temporary table.
      
To fix the problem, we have set the OPTION_KEEP_LOG into the thd->options
when a "CREATE TEMPORARY TABLE SELECT * FROM" is executed.
2010-05-19 18:01:12 +01:00
Jon Olav Hauglid
198d51efe7 manual merge from mysql-trunk-bugfixing 2010-05-18 14:52:51 +02:00
Jon Olav Hauglid
1c02ed3e67 manual merge from mysql-trunk-bugfixing 2010-05-18 14:52:51 +02:00
Sergei Golubchik
38b3218c4d merged 2010-05-15 14:44:06 +02:00
Alexander Nozdrin
6facd4cb13 Patch for Bug#27863 (excessive memory usage for many small queries in a
multiquery packet).

Background:

  - a query can contain multiple SQL statements;

  - the server frees resources allocated to process a query when the
    whole query is handled. In other words, resources allocated to process
    one SQL statement from a multi-statement query are freed when all SQL
    statements are handled.

The problem was that the parser allocated a buffer of size of the whole
query for each SQL statement in a multi-statement query. Thus, if a query
had many SQL-statements (so, the query was long), but each SQL statement
was short, ther parser tried to allocate huge amount of memory (number of
small SQL statements * length of the whole query).

The memory was allocated for a so-called "cpp buffer", which is intended to
store pre-processed SQL statement -- SQL text without version specific
comments.

The fix is to allocate memory for the "cpp buffer" once for all SQL
statements (once for a query).
2010-05-14 22:11:25 +04:00
Alexander Nozdrin
5c4333bc85 Patch for Bug#27863 (excessive memory usage for many small queries in a
multiquery packet).

Background:

  - a query can contain multiple SQL statements;

  - the server frees resources allocated to process a query when the
    whole query is handled. In other words, resources allocated to process
    one SQL statement from a multi-statement query are freed when all SQL
    statements are handled.

The problem was that the parser allocated a buffer of size of the whole
query for each SQL statement in a multi-statement query. Thus, if a query
had many SQL-statements (so, the query was long), but each SQL statement
was short, ther parser tried to allocate huge amount of memory (number of
small SQL statements * length of the whole query).

The memory was allocated for a so-called "cpp buffer", which is intended to
store pre-processed SQL statement -- SQL text without version specific
comments.

The fix is to allocate memory for the "cpp buffer" once for all SQL
statements (once for a query).
2010-05-14 22:11:25 +04:00
Alexander Nozdrin
4333980a49 Patch for Bug#21818 (Return value of ROW_COUNT() is incorrect
for ALTER TABLE, LOAD DATA).

ROW_COUNT is now assigned according to the following rules:

  - In my_ok():
    - for DML statements: to the number of affected rows;
    - for DDL statements: to 0.

  - In my_eof(): to -1 to indicate that there was a result set.

    We derive this semantics from the JDBC specification, where int
    java.sql.Statement.getUpdateCount() is defined to (sic) "return the
    current result as an update count; if the result is a ResultSet
    object or there are no more results, -1 is returned".

  - In my_error(): to -1 to be compatible with the MySQL C API and
    MySQL ODBC driver.

  - For SIGNAL statements: to 0 per WL#2110 specification. Zero is used
    since that's the "default" value of ROW_COUNT in the diagnostics area.

sql/protocol.cc:
  Fix a typo.
sql/sql_class.h:
  - Introduce THD::get_row_count_func() / THD::set_row_count_func();
  - Remove the CF_HAS_ROW_COUNT define
sql/sql_parse.cc:
  CF_HAS_ROW_COUNT was eliminated.
2010-05-14 09:28:51 +04:00
Alexander Nozdrin
7752ccec48 Patch for Bug#21818 (Return value of ROW_COUNT() is incorrect
for ALTER TABLE, LOAD DATA).

ROW_COUNT is now assigned according to the following rules:

  - In my_ok():
    - for DML statements: to the number of affected rows;
    - for DDL statements: to 0.

  - In my_eof(): to -1 to indicate that there was a result set.

    We derive this semantics from the JDBC specification, where int
    java.sql.Statement.getUpdateCount() is defined to (sic) "return the
    current result as an update count; if the result is a ResultSet
    object or there are no more results, -1 is returned".

  - In my_error(): to -1 to be compatible with the MySQL C API and
    MySQL ODBC driver.

  - For SIGNAL statements: to 0 per WL#2110 specification. Zero is used
    since that's the "default" value of ROW_COUNT in the diagnostics area.
2010-05-14 09:28:51 +04:00
Martin Hansson
79e60f0a40 Bug#48157: crash in Item_field::used_tables
MySQL handles the join syntax "JOIN ... USING( field1,
... )" and natural joins by building the same parse tree as
a corresponding join with an "ON t1.field1 = t2.field1 ..."
expression would produce. This parse tree was not cleaned up
properly in the following scenario. If a thread tries to
lock some tables and finds that the tables were dropped and
re-created while waiting for the lock, it cleans up column
references in the statement by means a per-statement free
list. But if the statement was part of a stored procedure,
column references on the stored procedure's free list
weren't cleaned up and thus contained pointers to freed
objects.
      
Fixed by adding a call to clean up the current prepared
statement's free list.

This is a backport from MySQL 5.1
2010-05-11 16:21:05 +02:00
Martin Hansson
27ac666fea Bug#48157: crash in Item_field::used_tables
MySQL handles the join syntax "JOIN ... USING( field1,
... )" and natural joins by building the same parse tree as
a corresponding join with an "ON t1.field1 = t2.field1 ..."
expression would produce. This parse tree was not cleaned up
properly in the following scenario. If a thread tries to
lock some tables and finds that the tables were dropped and
re-created while waiting for the lock, it cleans up column
references in the statement by means a per-statement free
list. But if the statement was part of a stored procedure,
column references on the stored procedure's free list
weren't cleaned up and thus contained pointers to freed
objects.
      
Fixed by adding a call to clean up the current prepared
statement's free list.

This is a backport from MySQL 5.1
2010-05-11 16:21:05 +02:00
unknown
0ae75abfb6 Automerge MariaDB 5.1.44b release. 2010-05-10 09:34:49 +02:00
unknown
fcfb218f71 Cherry-pick fix for Bug#53371, security hole with bypassing grants using special path in db/table names.
Bump MariaDB version for security fix release.
2010-05-09 21:30:06 +02:00
Alexey Kopytov
5ef2bdea81 Manual merge of mysql-5.1-bugteam to mysql-trunk-merge.
Conflicts:

Text conflict in mysql-test/r/grant.result
Text conflict in mysql-test/t/grant.test
Text conflict in mysys/mf_loadpath.c
Text conflict in sql/slave.cc
Text conflict in sql/sql_priv.h
2010-05-09 02:03:35 +04:00
Alexey Kopytov
ad43230e3b Manual merge of mysql-5.1-bugteam to mysql-trunk-merge.
Conflicts:

Text conflict in mysql-test/r/grant.result
Text conflict in mysql-test/t/grant.test
Text conflict in mysys/mf_loadpath.c
Text conflict in sql/slave.cc
Text conflict in sql/sql_priv.h
2010-05-09 02:03:35 +04:00
Konstantin Osipov
946fad3502 Draft patch that fixes and a sketches test cases for:
Bug#20837 Apparent change of isolation level during transaction,
Bug#46527 COMMIT AND CHAIN RELEASE does not make sense,
Bug#53343 completion_type=1, COMMIT/ROLLBACK AND CHAIN don't 
preserve the isolation level
Bug#53346 completion_type has strange effect in a stored 
procedure/prepared statement

Make thd->tx_isolation mean strictly "current transaction 
isolation level"
Make thd->variables.tx_isolation mean "current session isolation
level".
The current transaction isolation level is now established
at transaction start. If there was a SET TRANSACTION
ISOLATION LEVEL statement, the value is taken from it.
Otherwise, the session value is used.
A change in a session value, made while a transaction is active,
whereas still allowed, no longer has any effect on the
current transaction isolation level. This is an incompatible
change.
A change in a session isolation level, made while there is
no active transaction, overrides SET TRANSACTION statement,
if there was any.
Changed the impelmentation to not look at @@session.completion_type
in the parser, and thus fixed Bug#53346.
Changed the parser to not allow AND NO CHAIN RELEASE,
and thus fixed Bug#46527.
Changed the transaction API to take the current transaction
isolation level into account:
- BEGIN/COMMIT now do preserve the current transaction
isolation level if chaining is on.
- implicit commit, XA COMMIT or XA ROLLBACK or autocommit don't.
2010-05-07 20:28:59 +04:00
Konstantin Osipov
5ac769be68 Draft patch that fixes and a sketches test cases for:
Bug#20837 Apparent change of isolation level during transaction,
Bug#46527 COMMIT AND CHAIN RELEASE does not make sense,
Bug#53343 completion_type=1, COMMIT/ROLLBACK AND CHAIN don't 
preserve the isolation level
Bug#53346 completion_type has strange effect in a stored 
procedure/prepared statement

Make thd->tx_isolation mean strictly "current transaction 
isolation level"
Make thd->variables.tx_isolation mean "current session isolation
level".
The current transaction isolation level is now established
at transaction start. If there was a SET TRANSACTION
ISOLATION LEVEL statement, the value is taken from it.
Otherwise, the session value is used.
A change in a session value, made while a transaction is active,
whereas still allowed, no longer has any effect on the
current transaction isolation level. This is an incompatible
change.
A change in a session isolation level, made while there is
no active transaction, overrides SET TRANSACTION statement,
if there was any.
Changed the impelmentation to not look at @@session.completion_type
in the parser, and thus fixed Bug#53346.
Changed the parser to not allow AND NO CHAIN RELEASE,
and thus fixed Bug#46527.
Changed the transaction API to take the current transaction
isolation level into account:
- BEGIN/COMMIT now do preserve the current transaction
isolation level if chaining is on.
- implicit commit, XA COMMIT or XA ROLLBACK or autocommit don't.
2010-05-07 20:28:59 +04:00
Konstantin Osipov
9e62cf67b3 Clean-up, give better names, add comments to
thd->in_multi_stmt_transaction() and thd->active_transaction().


include/mysql_com.h:
  Comment SERVER_STATUS_IN_TRANS flag.
sql/ha_ndbcluster.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/handler.cc:
  Add comments.
sql/log.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/log_event.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/sql_base.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/sql_cache.cc:
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/sql_class.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/sql_class.h:
  Rename and comment two transaction processing- related methods.
sql/sql_parse.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/sql_prepare.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/sql_rename.cc:
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/sql_table.cc:
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/sys_vars.cc:
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/transaction.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
2010-05-06 02:02:08 +04:00
Konstantin Osipov
cca59e83d7 Clean-up, give better names, add comments to
thd->in_multi_stmt_transaction() and thd->active_transaction().
2010-05-06 02:02:08 +04:00
Jon Olav Hauglid
a03ce03977 merge from mysql-trunk-bugfixing 2010-05-05 09:25:04 +02:00
Jon Olav Hauglid
27da41cc2e merge from mysql-trunk-bugfixing 2010-05-05 09:25:04 +02:00
Georgi Kodinov
71b453fa06 Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
This is the 5.1 merge and extension of the fix.
The server was happily accepting paths in table name in all places a table
name is accepted (e.g. a SELECT). This allowed all users that have some 
privilege over some database to read all tables in all databases in all
mysql server instances that the server file system has access to.
Fixed by :
1. making sure no path elements are allowed in quoted table name when
constructing the path (note that the path symbols are still valid in table names
when they're properly escaped by the server).
2. checking the #mysql50# prefixed names the same way they're checked for
path elements in mysql-5.0.
2010-05-04 17:03:28 +03:00
Georgi Kodinov
0f26a0533b Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
This is the 5.1 merge and extension of the fix.
The server was happily accepting paths in table name in all places a table
name is accepted (e.g. a SELECT). This allowed all users that have some 
privilege over some database to read all tables in all databases in all
mysql server instances that the server file system has access to.
Fixed by :
1. making sure no path elements are allowed in quoted table name when
constructing the path (note that the path symbols are still valid in table names
when they're properly escaped by the server).
2. checking the #mysql50# prefixed names the same way they're checked for
path elements in mysql-5.0.
2010-05-04 17:03:28 +03:00
Georgi Kodinov
f63608ea97 Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
The server was not checking the supplied to COM_FIELD_LIST table name
for validity and compliance to acceptable table names standards.
Fixed by checking the table name for compliance similar to how it's 
normally checked by the parser and returning an error message if 
it's not compliant.
2010-05-03 18:16:51 +03:00
Georgi Kodinov
6ae9c70109 Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
The server was not checking the supplied to COM_FIELD_LIST table name
for validity and compliance to acceptable table names standards.
Fixed by checking the table name for compliance similar to how it's 
normally checked by the parser and returning an error message if 
it's not compliant.
2010-05-03 18:16:51 +03:00
unknown
d0b32f1af9 Automerge mariadb 5.1 -> mariadb 5.2 2010-05-05 15:12:14 +02:00
Alexey Kopytov
85ed11c60d Manual merge of mysql-5.1-bugteam to mysql-trunk-merge.
Conflicts:

Text conflict in configure.in
Text conflict in dbug/dbug.c
Text conflict in mysql-test/r/ps.result
Text conflict in mysql-test/t/ps.test
Text conflict in sql/CMakeLists.txt
Text conflict in sql/ha_ndbcluster.cc
Text conflict in sql/mysqld.cc
Text conflict in sql/sql_plugin.cc
Text conflict in sql/sql_table.cc
2010-04-30 00:33:06 +04:00
Alexey Kopytov
940ad61b71 Manual merge of mysql-5.1-bugteam to mysql-trunk-merge.
Conflicts:

Text conflict in configure.in
Text conflict in dbug/dbug.c
Text conflict in mysql-test/r/ps.result
Text conflict in mysql-test/t/ps.test
Text conflict in sql/CMakeLists.txt
Text conflict in sql/ha_ndbcluster.cc
Text conflict in sql/mysqld.cc
Text conflict in sql/sql_plugin.cc
Text conflict in sql/sql_table.cc
2010-04-30 00:33:06 +04:00
Davi Arnaut
54705ab176 Bug#50974: Server keeps receiving big (> max_allowed_packet) packets indefinitely.
The server could be tricked to read packets indefinitely if it
received a packet larger than the maximum size of one packet.
This problem is aggravated by the fact that it can be triggered
before authentication.

The solution is to no skip big packets for non-authenticated
sessions. If a big packet is sent before a session is authen-
ticated, a error is returned and the connection is closed.

include/mysql_com.h:
  Add skip flag. Only used in server builds.
sql/net_serv.cc:
  Control whether big packets can be skipped.
2010-04-29 10:28:16 -03:00
Davi Arnaut
14ccbeb4e4 Bug#50974: Server keeps receiving big (> max_allowed_packet) packets indefinitely.
The server could be tricked to read packets indefinitely if it
received a packet larger than the maximum size of one packet.
This problem is aggravated by the fact that it can be triggered
before authentication.

The solution is to no skip big packets for non-authenticated
sessions. If a big packet is sent before a session is authen-
ticated, a error is returned and the connection is closed.
2010-04-29 10:28:16 -03:00
unknown
07bfc5a2d6 Fix buffer overflow in COM_FIELD_LIST.
Fix missing bounds check in string conversion.
Bump version number for security fix release.
2010-04-29 09:57:25 +02:00
Ramil Kalimullin
2303a8c6e4 Manual merge. 2010-04-29 08:54:09 +04:00
Ramil Kalimullin
e287445d41 Manual merge. 2010-04-29 08:54:09 +04:00
Ramil Kalimullin
0d5dbb166b Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
Problem: "COM_FIELD_LIST is an old command of the MySQL server, before there was real move to only
SQL. Seems that the data sent to COM_FIELD_LIST( mysql_list_fields() function) is not
checked for sanity. By sending long data for the table a buffer is overflown, which can
be used deliberately to include code that harms".

Fix: check incoming data length.


sql/sql_parse.cc:
  Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
    - check incoming mysql_list_fields() table name arg length.
2010-04-29 08:42:32 +04:00
Ramil Kalimullin
933e5ca5f0 Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
Problem: "COM_FIELD_LIST is an old command of the MySQL server, before there was real move to only
SQL. Seems that the data sent to COM_FIELD_LIST( mysql_list_fields() function) is not
checked for sanity. By sending long data for the table a buffer is overflown, which can
be used deliberately to include code that harms".

Fix: check incoming data length.
2010-04-29 08:42:32 +04:00
unknown
b1e00b6be8 Merge MySQL 5.1.46 into MariaDB.
Still two test failures to be solved: main.myisam and main.subselect.
2010-04-28 14:52:24 +02:00
Konstantin Osipov
1ab519d91f Committing on behalf or Dmitry Lenev:
Fix for bug #46947 "Embedded SELECT without FOR UPDATE is
causing a lock", with after-review fixes.

SELECT statements with subqueries referencing InnoDB tables
were acquiring shared locks on rows in these tables when they
were executed in REPEATABLE-READ mode and with statement or
mixed mode binary logging turned on.

This was a regression which were introduced when fixing
bug 39843.

The problem was that for tables belonging to subqueries
parser set TL_READ_DEFAULT as a lock type. In cases when
statement/mixed binary logging at open_tables() time this
type of lock was converted to TL_READ_NO_INSERT lock at
open_tables() time and caused InnoDB engine to acquire
shared locks on reads from these tables. Although in some
cases such behavior was correct (e.g. for subqueries in
DELETE) in case of SELECT it has caused unnecessary locking.

This patch tries to solve this problem by rethinking our
approach to how we handle locking for SELECT and subqueries.
Now we always set TL_READ_DEFAULT lock type for all cases
when we read data. When at open_tables() time this lock
is interpreted as TL_READ_NO_INSERT or TL_READ depending
on whether this statement as a whole or call to function
which uses particular table should be written to the
binary log or not (if yes then statement should be properly
serialized with concurrent statements and stronger lock
should be acquired).

Test coverage is added for both InnoDB and MyISAM.

This patch introduces an "incompatible" change in locking
scheme for subqueries used in SELECT ... FOR UPDATE and
SELECT .. IN SHARE MODE.
In 4.1 the server would use a snapshot InnoDB read for 
subqueries in SELECT FOR UPDATE and SELECT .. IN SHARE MODE
statements, regardless of whether the binary log is on or off.
If the user required a different type of read (i.e. locking read),
he/she could request so explicitly by providing FOR UPDATE/IN SHARE MODE
clause for each individual subquery.
On of the patches for 5.0 broke this behaviour (which was not documented
or tested), and started to use locking reads fora all subqueries in SELECT ... 
FOR UPDATE/IN SHARE MODE. This patch restored 4.1 behaviour.

mysql-test/include/check_concurrent_insert.inc:
  Added auxiliary script which allows to check if statement
  reading table allows concurrent inserts in it.
mysql-test/include/check_no_concurrent_insert.inc:
  Added auxiliary script which allows to check that statement
  reading table doesn't allow concurrent inserts in it.
mysql-test/include/check_no_row_lock.inc:
  Added auxiliary script which allows to check if statement
  reading table doesn't take locks on its rows.
mysql-test/include/check_shared_row_lock.inc:
  Added auxiliary script which allows to check if statement
  reading table takes shared locks on some of its rows.
mysql-test/r/bug39022.result:
  After bug #46947 'Embedded SELECT without FOR UPDATE is
  causing a lock' was fixed test case for bug 39022 has to
  be adjusted in order to trigger execution path on which
  original problem was encountered.
mysql-test/r/innodb_mysql_lock2.result:
  Added coverage for handling of locking in various cases when
  we read data from InnoDB tables (includes test case for
  bug #46947 'Embedded SELECT without FOR UPDATE is causing a
  lock').
mysql-test/r/lock_sync.result:
  Added coverage for handling of locking in various cases when
  we read data from MyISAM tables.
mysql-test/t/bug39022.test:
  After bug #46947 'Embedded SELECT without FOR UPDATE is
  causing a lock' was fixed test case for bug 39022 has to
  be adjusted in order to trigger execution path on which
  original problem was encountered.
mysql-test/t/innodb_mysql_lock2.test:
  Added coverage for handling of locking in various cases when
  we read data from InnoDB tables (includes test case for
  bug #46947 'Embedded SELECT without FOR UPDATE is causing a
  lock').
mysql-test/t/lock_sync.test:
  Added coverage for handling of locking in various cases when
  we read data from MyISAM tables.
sql/log_event.cc:
  Since LEX::lock_option member was removed we no longer can
  rely on its value in Load_log_event::print_query() to
  determine that log event correponds to LOAD DATA CONCURRENT
  statement (this was not correct in all situations anyway).
  A new Load_log_event's member was introduced as a replacement.
  It is initialized at event object construction time and
  explicitly indicates whether LOAD DATA was concurrent.
sql/log_event.h:
  Since LEX::lock_option member was removed we no longer can
  rely on its value in Load_log_event::print_query() to
  determine that log event correponds to LOAD DATA CONCURRENT
  statement (this was not correct in all situations anyway).
  A new Load_log_event's member was introduced as a replacement.
  It is initialized at event object construction time and
  explicitly indicates whether LOAD DATA was concurrent.
sql/sp_head.cc:
  sp_head::reset_lex():
    Before parsing substatement reset part of parser state
    which needs this (e.g. set Yacc_state::m_lock_type to
    default value).
sql/sql_acl.cc:
  Since LEX::reset_n_backup_query_tables_list() now also
  resets LEX::sql_command member (as it became part of
  Query_tables_list class) we have to restore it in cases
  when while working with proxy Query_table_list we assume
  that LEX::sql_command still corresponds to original SQL
  command being executed (for example, when we are logging
  statement to the binary log while having Query_tables_list
  reset and backed up).
sql/sql_base.cc:
  Changed read_lock_type_for_table() to return a weak TL_READ
  type of lock in cases when we are executing statement which
  won't update tables directly and table doesn't belong to
  statement's prelocking list and thus can't be used by a
  stored function. It is OK to do so since in this case table
  won't be used by statement or function call which will be
  written to the binary log, so serializability requirements
  for it can be relaxed.
  One of results from this change is that SELECTs on InnoDB
  tables no longer takes shared row locks for tables which
  are used in subqueries (i.e. bug #46947 is fixed).
  Another result is that for similar SELECTs on MyISAM tables
  concurrent inserts are allowed.
  In order to implement this change signature of
  read_lock_type_for_table() function was changed to take
  pointers to Query_tables_list and TABLE_LIST objects.
sql/sql_base.h:
  - Function read_lock_type_for_table() now takes pointers
    to Query_tables_list and TABLE_LIST elements as its
    arguments since to correctly determine lock type it needs
    to know what statement is being performed and whether table
    element for which lock type to be determined belongs to
    prelocking list.
sql/sql_lex.cc:
  - Removed LEX::lock_option and st_select_lex::lock_option
    members. Places in parser that were using them now use
    Yacc_state::m_lock_type instead.
  - To emphasize that LEX::sql_command member is used during
    process of opening and locking of tables it was moved to
    Query_tables_list class. It is now reset by
    Query_tables_list::reset_query_tables_list() method.
sql/sql_lex.h:
  - Removed st_select_lex::lock_option member as there is no
    real need for per-SELECT lock type (HIGH_PRIORITY option
    should apply to the whole statement. FOR UPDATE/LOCK IN
    SHARE MODE clauses can be handled without this member).
    The main effect which was achieved by introduction of this
    member, i.e. using TL_READ_DEFAULT lock type for
    subqueries, is now achieved by setting LEX::lock_option
    (or rather its replacement - Yacc_state::m_lock_type) to
    TL_READ_DEFAULT in almost all cases.
  - To emphasize that LEX::sql_command member is used during
    process of opening and locking of tables it was moved to
    Query_tables_list class.
  - Replaced LEX::lock_option with Yacc_state::m_lock_type
    in order to emphasize that this value is relevant only
    during parsing. Unlike for LEX::lock_option the default
    value for Yacc_state::m_lock_type is TL_READ_DEFAULT.
    Note that for cases when it is OK to take a "weak" read
    lock (e.g. simple SELECT) this lock type will be converted
    to TL_READ at open_tables() time. So this change won't
    cause negative change in behavior for such statements.
    OTOH this change ensures that, for example, for SELECTs
    which are used in stored functions TL_READ_NO_INSERT lock
    is taken when necessary and as result calls to such stored
    functions can be written to the binary log with correct
    serialization.
sql/sql_load.cc:
  Load_log_event constructor now requires a parameter that
  indicates whether LOAD DATA is concurrent.
sql/sql_parse.cc:
  LEX::lock_option was replaced with Yacc_state::m_lock_type.
  And instead of resetting the latter implicitly in
  mysql_init_multi_delete() we do it explicitly in the
  places in parser which call this function.
sql/sql_priv.h:
  - To be able more easily distinguish high-priority SELECTs
    in st_select_lex::print() method added flag for
    HIGH_PRIORITY option.
sql/sql_select.cc:
  Changed code not to rely on LEX::lock_option to determine
  that it is high-priority SELECT. It was replaced with
  Yacc_state::m_lock_type which is accessible only at
  parse time. So instead of LEX::lock_option we now rely
  on a newly introduced flag for st_select_lex::options -
  SELECT_HIGH_PRIORITY.
sql/sql_show.cc:
  Since LEX::reset_n_backup_query_tables_list() now also
  resets LEX::sql_command member (as it became part of
  Query_tables_list class) we have to restore it in cases
  when while working with proxy Query_table_list we assume
  that LEX::sql_command still corresponds to original SQL
  command being executed.
sql/sql_table.cc:
  Since LEX::reset_query_tables_list() now also resets
  LEX::sql_command member (as it became part of
  Query_tables_list class) we have to restore value of this
  member when this method is called by mysql_admin_table(),
  to make this code safe for re-execution.
sql/sql_trigger.cc:
  Since LEX::reset_n_backup_query_tables_list() now also
  resets LEX::sql_command member (as it became part of
  Query_tables_list class) we have to restore it in cases
  when while working with proxy Query_table_list we assume
  that LEX::sql_command still corresponds to original SQL
  command being executed (for example, when we are logging
  statement to the binary log while having Query_tables_list
  reset and backed up).
sql/sql_update.cc:
  Function read_lock_type_for_table() now takes pointers
  to Query_tables_list and TABLE_LIST elements as its
  arguments since to correctly determine lock type it needs
  to know what statement is being performed and whether table
  element for which lock type to be determined belongs to
  prelocking list.
sql/sql_yacc.yy:
  - Removed st_select_lex::lock_option member as there is no
    real need for per-SELECT lock type (HIGH_PRIORITY option
    should apply to the whole statement. FOR UPDATE/LOCK IN
    SHARE MODE clauses can be handled without this member).
    The main effect which was achieved by introduction of this
    member, i.e. using TL_READ_DEFAULT lock type for
    subqueries, is now achieved by setting LEX::lock_option
    (or rather its replacement - Yacc_state::m_lock_type) to
    TL_READ_DEFAULT in almost all cases.
  - Replaced LEX::lock_option with Yacc_state::m_lock_type
    in order to emphasize that this value is relevant only
    during parsing. Unlike for LEX::lock_option the default
    value for Yacc_state::m_lock_type is TL_READ_DEFAULT.
    Note that for cases when it is OK to take a "weak" read
    lock (e.g. simple SELECT) this lock type will be converted
    to TL_READ at open_tables() time. So this change won't
    cause negative change in behavior for such statements.
    OTOH this change ensures that, for example, for SELECTs
    which are used in stored functions TL_READ_NO_INSERT lock
    is taken when necessary and as result calls to such stored
    functions can be written to the binary log with correct
    serialization.
  - To be able more easily distinguish high-priority SELECTs
    in st_select_lex::print() method we now use new flag
    in st_select_lex::options bit-field.
2010-04-28 14:04:11 +04:00