database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-01-06 05:22:24 +03:00
Code Activity
180,618 Commits 3,346 Branches 1,099 Tags
fa2a74e08d00bcf8ddb1d98dba767e9bd1ed802d
Commit Graph

1166 Commits

Author SHA1 Message Date
Alexander Barkov
5c5a116b47 MDEV-16614 signal 7 after calling stored procedure, that uses regexp 
The problem happened in the derived condition pushdown code:
- When Item_func_regex::build_clone() was called, it created a copy of
  the original Item_func_regex, and this copy got registered in free_list.
  Class specific additional dynamic members (such as "re") made
  a shallow copy, rather than a deep copy, in the cloned Item_func_regex.
  As a result, the Regexp_processor_pcre::m_pcre of the cloned Item_func_regex
  and of the original Item_func_regex pointed to the same compiled regular
  expression.
- On cleanup_items(), both original and cloned copies of Item_func_regex
  called re.cleanup(), which called pcre_free(m_pcre). So the same compiled
  regular expression was freed two times, which was noticed by ASAN.

The same problem was repeatable for Item_func_regexp_instr.

A similar problem happened for Item_func_sp, for the sp_result_field member.
Both original and cloned copies of Item_func_sp pointed the same Field instance
and both deleted it on cleanup().

A possible solution would be to fix build_clone() to create deep
(instead of shallow) copies for the dynamic members of the affected classes
(Item_func_regex, Item_func_regexp_instr, Item_func sp).
However, this would be too complex.

As agreed with Galina and Igor, this patch disallows using using these
affected classes in derived condition pushdown by overriding get_clone()
to return NULL.
 2018-07-26 13:05:22 +04:00
Oleksandr Byelkin
6b8802e8dd MDEV-11071: Assertion `thd->transaction.stmt.is_empty()' failed in Locked_tables_list::unlock_locked_table 
fix_length_and_dec now return result (error/OK)
 2018-06-15 10:31:30 +02:00
Galina Shalygina
6c0f3dd341 MDEV-16090: Server crash in in Item_func_in::val_int or assertion `in_item' 
failure upon SELECT with impossible condition

The problem appears because of a wrong implementation of the
Item_func_in::build_clone() method. It didn't clone 'array' and 'cmp_fields'
fields for the cloned IN predicate and this could cause crashes.
The Item_func_in::fix_length_and_dec() method was refactored and a new method
named Item_func_in::create_array() was created. It allowed to create 'array'
for cloned IN predicates in a proper way.
 2018-05-12 20:32:16 +02:00
Sergei Golubchik
c764bc0a78 Merge branch '10.1' into 10.2 2018-03-25 13:02:52 +02:00
Sergei Golubchik
febe1e8503 Merge branch '10.0' into 10.1 2018-03-23 17:40:53 +01:00
Sergei Golubchik
a2e47f8c41 Merge branch '5.5' into 10.0 2018-03-23 11:44:29 +01:00
Marko Mäkelä
e80a842000 Merge 10.1 into 10.2 2018-03-22 18:02:40 +02:00
Alexander Barkov
0cba2c1ccb MDEV-15633 Memory leak after MDEV-15005 2018-03-22 16:23:37 +04:00
Varun Gupta
ddc5c65333 MDEV-14779: using left join causes incorrect results with materialization and derived tables 
Conversion of a subquery to a semi-join is blocked when we have an
IN subquery predicate in the on_expr of an outer join. Currently this
scenario is handled but the cases when an IN subquery predicate is wrapped
inside a Item_in_optimizer item then this blocking is not done.
 2018-03-22 03:01:53 +05:30
Vicențiu Ciorbaru
82aeb6b596 Merge branch '10.1' into 10.2 2018-03-21 10:36:49 +02:00
Alexander Barkov
f538a64817 MDEV-15005 ASAN: stack-buffer-overflow in my_strnncollsp_simple 
cmp_item_sort_string::store_value() did not cache the string returned
from item->val_str(), whose result can point to various private members
such as Item_char_typecast::tmp_value.

- cmp_item_sort_string::store_value() remembered the pointer returned
  from item->val_str() poiting to tmp_value into cmp_item_string::value_res.
- Later, cmp_item_real::store_value() was called, which called
  Item_str_func::val_real(), which called Item_char_typecast::val_str(&tmp)
  using a local stack variable "String tmp". Item_char_typecast::tmp_value
  was overwritten and become a link to "tmp":
  tmp_value.Ptr freed its own buffer and set to point to the buffer
  owned by "tmp".
- On return from Item_str_func::val_real(), "String tmp" was destructed,
  but "tmp_value" still pointed to the buffer owned by "tmp",
  So tmp_value.Ptr became invalid.
- Then cmp_item_sort_string() passed cmp_item_string::value_res to sortcmp().
  At this point, value_res still pointed to an invalid value of
  Item_char_typecast::tmp_value.

Fix:
changing cmp_item_sort_string::store_value() to force copying
to cmp_item_string::value if item->val_str(&value) returned
a different pointer (instead of &value).
 2018-03-19 13:07:41 +04:00
Sergei Golubchik
27d94b7e03 cleanup: remove get_datetime_value() 2018-03-14 12:45:46 +01:00
Sergei Golubchik
d390e501eb MDEV-11839 move value caching from get_datetime_value to fix_fields time 
Refactor get_datetime_value() not to create Item_cache_temporal(),
but do it always in ::fix_fields() or ::fix_length_and_dec().

Creating items at the execution time doesn't work very well with
virtual columns and check constraints that are fixed and executed
in different THDs.
 2018-03-14 12:45:28 +01:00
Sergei Golubchik
24d6cd7d62 cleanup: Arg_comparator::cache_converted_constant() 
It's a generic function, not using anything from Arg_comparator.
Make it a static function, not a class method, to be able to use
it later without Arg_comparator
 2018-03-14 12:40:00 +01:00
Sergei Golubchik
75ac5789b4 cleanup: typos, comments, whitespace 2018-03-14 12:40:00 +01:00
Sergei Golubchik
bf1ca14ff3 cleanup: Item_func_case 
reorder items in args[] array. Instead of

  when1,then1,when2,then2,...[,case][,else]

sort them as

  [case,]when1,when2,...,then1,then2,...[,else]

in this case all items used for comparison take a continuous part
of the array and can be aggregated directly. and all items that
can be returned take a continuous part of the array and can be
aggregated directly. Old code had to copy them to a temporary
array before aggreation, and then copy back (thd->change_item_tree)
everything that was changed.
 2018-03-14 12:40:00 +01:00
Sergei Golubchik
4771ae4b22 Merge branch 'github/10.1' into 10.2 2018-02-06 14:50:50 +01:00
Sergei Golubchik
d4df7bc9b1 Merge branch 'github/10.0' into 10.1 2018-02-02 10:09:44 +01:00
Vicențiu Ciorbaru
d833bb65d5 Merge remote-tracking branch '5.5' into 10.0 2018-01-24 12:29:31 +02:00
Oleksandr Byelkin
76577e1e26 typo fix 2018-01-24 10:58:27 +01:00
Oleksandr Byelkin
ba8d0fa700 MDEV-14786: Server crashes in Item_cond::transform on 2nd execution of SP querying from a view 
MDEV-14957: JOIN::prepare gets unusable "conds" as argument

Do not touch merged derived (it is irreversible)

Fix first argument of in_optimizer for calls possible before fix_fields()
 2018-01-23 13:42:41 +01:00
Vicențiu Ciorbaru
985d2d393c Merge remote-tracking branch 'origin/10.1' into 10.2 2017-12-22 12:23:39 +02:00
Vicențiu Ciorbaru
e3d89652e5 Merge branch '10.0' into 10.1 2017-12-20 13:30:05 +02:00
Vicențiu Ciorbaru
042f763268 Merge remote-tracking branch '5.5' into 10.0 2017-12-20 12:51:57 +02:00
Alexander Barkov
20089f5a39 MDEV-14596 Crash in INTERVAL(ROW(..),ROW(..)) 2017-12-08 14:40:27 +04:00
Alexander Barkov
62333983e4 Merge remote-tracking branch 'origin/10.1' into 10.2 2017-11-09 15:41:26 +04:00
Alexander Barkov
0fdb0bdf27 Merge remote-tracking branch 'origin/10.0' into 10.1 2017-11-09 14:05:53 +04:00
Oleksandr Byelkin
c2c93fc6e4 MDEV-14164: Unknown column error when adding aggregate to function in oracle style procedure FOR loop 
Make differentiation between pullout for merge and pulout of outer field during exists2in transformation.
In last case the field was outer and so we can safely start from name resolution context of the SELECT where it was pulled.
Old behavior lead to inconsistence between list of tables and outer name resolution context (which skips one SELECT for merge purposes) which creates problem vor name resolution.
 2017-11-09 09:31:03 +01:00
Sergei Golubchik
cb1e76e4de Merge branch '10.1' into 10.2 2017-08-17 11:38:34 +02:00
Alexey Botchkov
79d2853354 MDEV-12604 Comparison of JSON_EXTRACT result differs with Mysql. 
JSON_EXTRACT behaves specifically in the comparison,
        so we have to implement specific method for that in
        Arg_comparator.
 2017-08-11 00:50:29 +04:00
Sergei Golubchik
8e8d42ddf0 Merge branch '10.0' into 10.1 2017-08-08 10:18:43 +02:00
Sergei Golubchik
2fcd8c1252 MDEV-13173 An RLIKE that previously worked on 10.0 now returns "Got error 'pcre_exec: recursion limit of 100 exceeded' from regexp" 
1. use Regexp_processor_pcre::set_recursion_limit() to set the
   recursion limit depending on the current available stack size
2. make pcre stack frame to be estimated no less than 500 bytes.
   sometimes pcre estimates it too low, even though the manual
   says 500+16 bytes (it was estimated only 188 for me, actual
   frame size was 512).
3. do it for embedded too
 2017-07-20 20:13:28 +02:00
Sergei Golubchik
75f80004b1 MDEV-12939 A query crashes MariaDB in Item_func_regex::cleanup 
and
MDEV-13144 regexp on views - crashed mariadb server

implement Item_func_regex::build_clone()
 2017-07-05 17:15:57 +02:00
Vicențiu Ciorbaru
31ba0fa48d MDEV-12851: Case with window functions query crashes server 
The "is null" function performs one operation which no other Item_func
does, which is to update used tables during fix_length_and_dec().

This however can not be performed before window functions have had a
chance to resolve their order by and partition by definitions, which
happens after the initial setup_fields call. Consequently, do not call
Item_func_isnull update_used_tables during fix_length_and_dec().

There was another issue detected once the crash was resolved.
Because window functions did not implement is_null() method, we would
end up returning bad results for "is null" and "is not null" functions.
Implemented is_null() method for Item_windowfunc.
 2017-06-28 19:21:31 +03:00
Igor Babaev
9f3622191d Fixed the bug mdev-12845. 
This patch fills in a serious flaw in the
code that supports condition pushdown into
materialized views / derived tables.

If a predicate happened to contain a reference
to a mergeable view / derived table and it does
not depended directly on the target materialized
view / derived table then the predicate was not
considered as a subject to pusdown to this view
/ derived table.
 2017-06-22 22:06:03 -07:00
Marko Mäkelä
2d8fdfbde5 Merge 10.1 into 10.2 
Replace have_innodb_zip.inc with innodb_page_size_small.inc.
 2017-06-08 12:45:08 +03:00
Sergei Golubchik
5e0038b376 cleanup: remove Regexp_processor_pcre::m_subpatterns_needed 
it's unused now.
 2017-05-29 21:07:54 +02:00
Marko Mäkelä
70505dd45b Merge 10.1 into 10.2 2017-05-22 09:46:51 +03:00
Marko Mäkelä
13a350ac29 Merge 10.0 into 10.1 2017-05-19 12:29:37 +03:00
Sergei Golubchik
52aa200919 MDEV-12420 max_recursive_iterations did not prevent a stack-overflow and segfault 
post-review fixes
* move pcre-specific variable out of mysys
* don't use current_thd
* move a commonly used macro to my_sys.h
* remove new sysvar
 2017-05-15 22:23:10 +02:00
Daniel Black
602b5e4c49 WIP: global readonly variable pcre_frame_size 2017-05-15 22:23:10 +02:00
Daniel Black
d672f88ef7 MDEV-12420: PCRE stack overflow 
It was possible to construct a PCRE expression that exceeded the stack.
resulting in a crash:

With fix:

MariaDB [(none)]> SELECT 1
    -> FROM dual
    -> WHERE ('Alpha,Bravo,Charlie,Delta,Echo,Foxtrot,StrataCentral,Golf,Hotel,India,Juliet,Kilo,Lima,Mike,StrataL3,November,Oscar,StrataL2,Sand,P3,P4SwitchTest,Arsys,Poppa,ExtensionMgr,Arp,Quebec,Romeo,StrataApiV2,PtReyes,Sierra,SandAcl,Arrow,Artools,BridgeTest,Tango,SandT,PAlaska,Namespace,Agent,Qos,PatchPanel,ProjectReport,Ark,Gimp,Agent,SliceAgent,Arnet,Bgp,Ale,Tommy,Central,AsicPktTestLib,Hsc,SandL3,Abuild,Pca9555,Standby,ControllerDut,CalSys,SandLib,Sb820,PointV2,BfnLib,Evpn,BfnSdk,Sflow,ManagementActive,AutoTest,GatedTest,Bgp,Sand,xinetd,BfnAgentLib,bf-utils,Hello,BfnState,Eos,Artest,Qos,Scd,ThermoMgr,Uniform,EosUtils,Eb,FanController,Central,BfnL3,BfnL2,tcp_wrappers,Victor,Environment,Route,Failover,Whiskey,Xray,Gimp,BfnFixed,Strata,SoCal,XApi,Msrp,XpProfile,tcpdump,PatchPanel,ArosTest,FhTest,Arbus,XpAcl,MacConc,XpApi,telnet,QosTest,Alpha2,BfnVlan,Stp,VxlanControllerTest,MplsAgent,Bravo2,Lanz,BfnMbb,Intf,XCtrl,Unicast,SandTunnel,L3Unicast,Ipsec,MplsTest,Rsvp,EthIntf,StageMgr,Sol,MplsUtils,Nat,Ira,P4NamespaceDut,Counters,Charlie2,Aqlc,Mlag,Power,OpenFlow,Lag,RestApi,BfdTest,strongs,Sfa,CEosUtils,Adt746,MaintenanceMode,MlagDut,EosImage,IpEth,MultiProtocol,Launcher,Max3179,Snmp,Acl,IpEthTest,PhyEee,bf-syslibs,tacc,XpL2,p4-ar-switch,p4-bf-switch,LdpTest,BfnPhy,Mirroring,Phy6,Ptp'
    ->
    -> REGEXP '^((?!\b(Strata|StrataApi|StrataApiV2)\b).)*$');
Empty set, 1 warning (0.00 sec)

MariaDB [(none)]> show warnings;
+---------+------+---------------------------------------------------------+
| Level   | Code | Message                                                 |
+---------+------+---------------------------------------------------------+
| Warning | 1139 | Got error 'pcre_exec: Internal error (-21)' from regexp |
+---------+------+---------------------------------------------------------+
 2017-05-15 22:23:10 +02:00
Igor Babaev
00ab154d49 Fixed bug mdev-10454. 
The patch actually fixes the old defect of the optimizer that
could not extract keys for range access from IN predicates
with row arguments.

This problem was resolved in the mysql-5.7 code. The patch
supersedes what was done there:
 - it can build range access when not all components of
 the first row argument are refer to the columns of the table
 for which the range access is constructed.
 - it can use equality predicates to build range access
 to the table that is not referred to in this argument.
 2017-04-03 15:59:38 -07:00
Sergei Golubchik
da4d71d10d Merge branch '10.1' into 10.2 2017-03-30 12:48:42 +02:00
Marko Mäkelä
ad0c218a44 Merge 10.0 into 10.1 
Also, implement MDEV-11027 a little differently from 5.5 and 10.0:

recv_apply_hashed_log_recs(): Change the return type back to void
(DB_SUCCESS was always returned).

Report progress also via systemd using sd_notifyf().
 2017-03-09 08:53:08 +02:00
Sergei Golubchik
2195bb4e41 Merge branch '10.1' into 10.2 2017-02-10 17:01:45 +01:00
Sergei Golubchik
f7d030489d Merge branch '10.0' into 10.1 2017-01-17 20:17:35 +01:00
Sergei Golubchik
6728aae3b3 Merge branch '5.5' into 10.0 2017-01-17 16:22:25 +01:00
Sergei Golubchik
67e2028161 MDEV-9690 concurrent queries with virtual columns crash in temporal code 
Item_func_le included Arg_comparator. Arg_comparator remembered
the current_thd during fix_fields and used that value during
execution to allocate Item_cache in get_datetime_value().
But for vcols fix_fields and val_int can happen in different threads.

Same bug for Item_func_in using in_datetime or cmp_item_datetime,
both also remembered current_thd at fix_fields() to use it later
for get_datetime_value().

As a fix, these objects no longer remember the current_thd,
and get_datetime_value() uses current_thd at run time. This
should not increase the number of current_thd calls much, as
Item_cache is created only once anyway.
 2017-01-15 00:11:02 +01:00
Sergei Golubchik
4a5d25c338 Merge branch '10.1' into 10.2 2016-12-29 13:23:18 +01:00