merged 5.1-main -> 5.1-bugteam

configure.in

@@ -10,7 +10,7 @@ AC_CANONICAL_SYSTEM
 #
 # When changing major version number please also check switch statement
 # in mysqlbinlog::check_master_version().
-AM_INIT_AUTOMAKE(mysql, 5.1.34)
+AM_INIT_AUTOMAKE(mysql, 5.1.35)
 AM_CONFIG_HEADER([include/config.h:config.h.in])
 
 PROTOCOL_VERSION=10

mysql-test/extra/binlog_tests/binlog.test

@@ -164,6 +164,46 @@ DROP TABLE t1;
 DROP DATABASE bug39182;
 USE test;
 
+#
+# Bug#35383: binlog playback and replication breaks due to 
+# name_const substitution
+#
+DELIMITER //;
+CREATE PROCEDURE p1(IN v1 INT)
+BEGIN
+  CREATE TABLE t1 SELECT v1;
+  DROP TABLE t1;
+END//
+CREATE PROCEDURE p2()
+BEGIN
+  DECLARE v1 INT;
+  CREATE TABLE t1 SELECT v1+1;
+  DROP TABLE t1;
+END//
+CREATE PROCEDURE p3(IN v1 INT)
+BEGIN
+  CREATE TABLE t1 SELECT 1 FROM DUAL WHERE v1!=0;
+  DROP TABLE t1;
+END//
+CREATE PROCEDURE p4(IN v1 INT)
+BEGIN
+  DECLARE v2 INT;
+  CREATE TABLE t1 SELECT 1, v1, v2;
+  DROP TABLE t1;
+  CREATE TABLE t1 SELECT 1, v1+1, v2;
+  DROP TABLE t1;
+END//
+DELIMITER ;//
+
+CALL p1(1);
+CALL p2();
+CALL p3(0);
+CALL p4(0);
+DROP PROCEDURE p1;
+DROP PROCEDURE p2;
+DROP PROCEDURE p3;
+DROP PROCEDURE p4;
+
 --echo End of 5.0 tests
 
 # Test of a too big SET INSERT_ID: see if the truncated value goes

mysql-test/r/archive.result

@@ -12695,22 +12695,3 @@ a	b
 1	NULL
 2	NULL
 DROP TABLE t1;
-#
-# BUG#32880 - Repairing Archive table fails with internal error 144
-#
-
-# Test with an existing table which is corrupted
-# Copy t1 from std_data
-SHOW CREATE TABLE t1;
-Table	Create Table
-t1	CREATE TABLE `t1` (
-  `a` int(11) DEFAULT NULL,
-  `b` blob
-) ENGINE=ARCHIVE DEFAULT CHARSET=latin1
-CHECK TABLE t1;
-Table	Op	Msg_type	Msg_text
-test.t1	check	error	Corrupt
-REPAIR TABLE t1;
-Table	Op	Msg_type	Msg_text
-test.t1	repair	error	Corrupt
-DROP TABLE t1;

mysql-test/suite/binlog/r/binlog_row_binlog.result

@@ -1137,6 +1137,38 @@ DROP PROCEDURE p1;
 DROP TABLE t1;
 DROP DATABASE bug39182;
 USE test;
+CREATE PROCEDURE p1(IN v1 INT)
+BEGIN
+CREATE TABLE t1 SELECT v1;
+DROP TABLE t1;
+END//
+CREATE PROCEDURE p2()
+BEGIN
+DECLARE v1 INT;
+CREATE TABLE t1 SELECT v1+1;
+DROP TABLE t1;
+END//
+CREATE PROCEDURE p3(IN v1 INT)
+BEGIN
+CREATE TABLE t1 SELECT 1 FROM DUAL WHERE v1!=0;
+DROP TABLE t1;
+END//
+CREATE PROCEDURE p4(IN v1 INT)
+BEGIN
+DECLARE v2 INT;
+CREATE TABLE t1 SELECT 1, v1, v2;
+DROP TABLE t1;
+CREATE TABLE t1 SELECT 1, v1+1, v2;
+DROP TABLE t1;
+END//
+CALL p1(1);
+CALL p2();
+CALL p3(0);
+CALL p4(0);
+DROP PROCEDURE p1;
+DROP PROCEDURE p2;
+DROP PROCEDURE p3;
+DROP PROCEDURE p4;
 End of 5.0 tests
 reset master;
 create table t1 (id tinyint auto_increment primary key);

mysql-test/suite/binlog/r/binlog_stm_binlog.result

@@ -644,6 +644,38 @@ DROP PROCEDURE p1;
 DROP TABLE t1;
 DROP DATABASE bug39182;
 USE test;
+CREATE PROCEDURE p1(IN v1 INT)
+BEGIN
+CREATE TABLE t1 SELECT v1;
+DROP TABLE t1;
+END//
+CREATE PROCEDURE p2()
+BEGIN
+DECLARE v1 INT;
+CREATE TABLE t1 SELECT v1+1;
+DROP TABLE t1;
+END//
+CREATE PROCEDURE p3(IN v1 INT)
+BEGIN
+CREATE TABLE t1 SELECT 1 FROM DUAL WHERE v1!=0;
+DROP TABLE t1;
+END//
+CREATE PROCEDURE p4(IN v1 INT)
+BEGIN
+DECLARE v2 INT;
+CREATE TABLE t1 SELECT 1, v1, v2;
+DROP TABLE t1;
+CREATE TABLE t1 SELECT 1, v1+1, v2;
+DROP TABLE t1;
+END//
+CALL p1(1);
+CALL p2();
+CALL p3(0);
+CALL p4(0);
+DROP PROCEDURE p1;
+DROP PROCEDURE p2;
+DROP PROCEDURE p3;
+DROP PROCEDURE p4;
 End of 5.0 tests
 reset master;
 create table t1 (id tinyint auto_increment primary key);

mysql-test/suite/funcs_1/r/processlist_priv_ps.result

@@ -27,7 +27,7 @@ PROCESSLIST	CREATE TEMPORARY TABLE `PROCESSLIST` (
   `HOST` varchar(64) NOT NULL DEFAULT '',
   `DB` varchar(64) DEFAULT NULL,
   `COMMAND` varchar(16) NOT NULL DEFAULT '',
-  `TIME` bigint(7) NOT NULL DEFAULT '0',
+  `TIME` int(7) NOT NULL DEFAULT '0',
   `STATE` varchar(64) DEFAULT NULL,
   `INFO` longtext
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8
@@ -97,7 +97,7 @@ PROCESSLIST	CREATE TEMPORARY TABLE `PROCESSLIST` (
   `HOST` varchar(64) NOT NULL DEFAULT '',
   `DB` varchar(64) DEFAULT NULL,
   `COMMAND` varchar(16) NOT NULL DEFAULT '',
-  `TIME` bigint(7) NOT NULL DEFAULT '0',
+  `TIME` int(7) NOT NULL DEFAULT '0',
   `STATE` varchar(64) DEFAULT NULL,
   `INFO` longtext
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8

mysql-test/suite/funcs_1/r/processlist_val_ps.result

@@ -17,7 +17,7 @@ PROCESSLIST	CREATE TEMPORARY TABLE `PROCESSLIST` (
   `HOST` varchar(64) NOT NULL DEFAULT '',
   `DB` varchar(64) DEFAULT NULL,
   `COMMAND` varchar(16) NOT NULL DEFAULT '',
-  `TIME` bigint(7) NOT NULL DEFAULT '0',
+  `TIME` int(7) NOT NULL DEFAULT '0',
   `STATE` varchar(64) DEFAULT NULL,
   `INFO` longtext
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8

mysql-test/suite/rpl/r/rpl_loadfile.result

@@ -233,7 +233,7 @@ include/start_slave.inc
 SELECT repeat('x',20) INTO OUTFILE 'MYSQLTEST_VARDIR/tmp/bug_39701.data';
 DROP TABLE IF EXISTS t1;
 CREATE TABLE t1 (t text);
-CREATE PROCEDURE p(file TEXT) 
+CREATE PROCEDURE p(file varchar(4096)) 
 BEGIN
 INSERT INTO t1 VALUES (LOAD_FILE(file));
 END|

mysql-test/suite/rpl/r/rpl_row_wide_table.result

+stop slave;
+drop table if exists t1,t2,t3,t4,t5,t6,t7,t8,t9;
+reset master;
+reset slave;
+drop table if exists t1,t2,t3,t4,t5,t6,t7,t8,t9;
+start slave;
+DROP TABLE IF EXISTS t300;
+create table t300 (
+f1 int,
+f2 int,
+f3 int,
+f4 int,
+f5 int,
+f6 int,
+f7 int,
+f8 int,
+f9 int,
+f10 int,
+f11 int,
+f12 int,
+f13 int,
+f14 int,
+f15 int,
+f16 int,
+f17 int,
+f18 int,
+f19 int,
+f20 int,
+f21 int,
+f22 int,
+f23 int,
+f24 int,
+f25 int,
+f26 int,
+f27 int,
+f28 int,
+f29 int,
+f30 int,
+f31 int,
+f32 int,
+f33 int,
+f34 int,
+f35 int,
+f36 int,
+f37 int,
+f38 int,
+f39 int,
+f40 int,
+f41 int,
+f42 int,
+f43 int,
+f44 int,
+f45 int,
+f46 int,
+f47 int,
+f48 int,
+f49 int,
+f50 int,
+f51 int,
+f52 int,
+f53 int,
+f54 int,
+f55 int,
+f56 int,
+f57 int,
+f58 int,
+f59 int,
+f60 int,
+f61 int,
+f62 int,
+f63 int,
+f64 int,
+f65 int,
+f66 int,
+f67 int,
+f68 int,
+f69 int,
+f70 int,
+f71 int,
+f72 int,
+f73 int,
+f74 int,
+f75 int,
+f76 int,
+f77 int,
+f78 int,
+f79 int,
+f80 int,
+f81 int,
+f82 int,
+f83 int,
+f84 int,
+f85 int,
+f86 int,
+f87 int,
+f88 int,
+f89 int,
+f90 int,
+f91 int,
+f92 int,
+f93 int,
+f94 int,
+f95 int,
+f96 int,
+f97 int,
+f98 int,
+f99 int,
+f100 int,
+f101 int,
+f102 int,
+f103 int,
+f104 int,
+f105 int,
+f106 int,
+f107 int,
+f108 int,
+f109 int,
+f110 int,
+f111 int,
+f112 int,
+f113 int,
+f114 int,
+f115 int,
+f116 int,
+f117 int,
+f118 int,
+f119 int,
+f120 int,
+f121 int,
+f122 int,
+f123 int,
+f124 int,
+f125 int,
+f126 int,
+f127 int,
+f128 int,
+f129 int,
+f130 int,
+f131 int,
+f132 int,
+f133 int,
+f134 int,
+f135 int,
+f136 int,
+f137 int,
+f138 int,
+f139 int,
+f140 int,
+f141 int,
+f142 int,
+f143 int,
+f144 int,
+f145 int,
+f146 int,
+f147 int,
+f148 int,
+f149 int,
+f150 int,
+f151 int,
+f152 int,
+f153 int,
+f154 int,
+f155 int,
+f156 int,
+f157 int,
+f158 int,
+f159 int,
+f160 int,
+f161 int,
+f162 int,
+f163 int,
+f164 int,
+f165 int,
+f166 int,
+f167 int,
+f168 int,
+f169 int,
+f170 int,
+f171 int,
+f172 int,
+f173 int,
+f174 int,
+f175 int,
+f176 int,
+f177 int,
+f178 int,
+f179 int,
+f180 int,
+f181 int,
+f182 int,
+f183 int,
+f184 int,
+f185 int,
+f186 int,
+f187 int,
+f188 int,
+f189 int,
+f190 int,
+f191 int,
+f192 int,
+f193 int,
+f194 int,
+f195 int,
+f196 int,
+f197 int,
+f198 int,
+f199 int,
+f200 int,
+f201 int,
+f202 int,
+f203 int,
+f204 int,
+f205 int,
+f206 int,
+f207 int,
+f208 int,
+f209 int,
+f210 int,
+f211 int,
+f212 int,
+f213 int,
+f214 int,
+f215 int,
+f216 int,
+f217 int,
+f218 int,
+f219 int,
+f220 int,
+f221 int,
+f222 int,
+f223 int,
+f224 int,
+f225 int,
+f226 int,
+f227 int,
+f228 int,
+f229 int,
+f230 int,
+f231 int,
+f232 int,
+f233 int,
+f234 int,
+f235 int,
+f236 int,
+f237 int,
+f238 int,
+f239 int,
+f240 int,
+f241 int,
+f242 int,
+f243 int,
+f244 int,
+f245 int,
+f246 int,
+f247 int,
+f248 int,
+f249 int,
+f250 int,
+f251 int,
+f252 int,
+f253 int,
+f254 int,
+f255 int,
+f256 int,
+f257 int,
+f258 int,
+f259 int,
+f260 int,
+f261 int,
+f262 int,
+f263 int,
+f264 int,
+f265 int,
+f266 int,
+f267 int,
+f268 int,
+f269 int,
+f270 int,
+f271 int,
+f272 int,
+f273 int,
+f274 int,
+f275 int,
+f276 int,
+f277 int,
+f278 int,
+f279 int,
+f280 int,
+f281 int,
+f282 int,
+f283 int,
+f284 int,
+f285 int,
+f286 int,
+f287 int,
+f288 int,
+f289 int,
+f290 int,
+f291 int,
+f292 int,
+f293 int,
+f294 int,
+f295 int,
+f296 int,
+f297 int,
+f298 int,
+f299 int,
+f300 int,
+primary key (f1));
+insert into t300 set f1= 1;
+select f300 from t300;
+f300
+NULL
+select count(*) as one from t300;
+one
+1
+*** Cleanup  ***
+DROP TABLE t300;

mysql-test/suite/rpl/r/rpl_temporary.result

@@ -108,3 +108,16 @@ select * from t1;
 a
 1
 drop table t1;
+-- Bug#43748
+-- make a user on the slave that can list but not kill system threads.
+FLUSH PRIVILEGES;
+GRANT USAGE   ON *.* TO user43748@127.0.0.1 IDENTIFIED BY 'meow';
+GRANT PROCESS ON *.* TO user43748@127.0.0.1;
+-- try to KILL system-thread as that non-privileged user (on slave).
+SELECT id INTO @id FROM information_schema.processlist WHERE user='system user' LIMIT 1;
+KILL @id;
+Got one of the listed errors
+-- throw out test-user on slave.
+DROP USER user43748@127.0.0.1;
+-- done. back to master.
+End of 5.1 tests

mysql-test/suite/rpl/t/disabled.def

@@ -11,3 +11,4 @@
 ##############################################################################
 
 rpl_binlog_corruption : BUG#41793 2008-12-30 sven rpl_binlog_corruption disabled in main (needs new mtr)
+rpl_cross_version      : BUG#42311 2009-03-27 joro rpl_cross_version fails on macosx

mysql-test/suite/rpl/t/rpl_loadfile.test

@@ -73,7 +73,7 @@ enable_warnings;
 
 CREATE TABLE t1 (t text);
 DELIMITER |;
-CREATE PROCEDURE p(file TEXT) 
+CREATE PROCEDURE p(file varchar(4096)) 
   BEGIN
     INSERT INTO t1 VALUES (LOAD_FILE(file));
   END|

mysql-test/suite/rpl/t/rpl_row_wide_table.test

+##################################################################
+#  rpl_row_wide_table
+#                                                               
+# This test verifies that the table with number of attributes more
+# than 250  is replicated.
+# Related bugs:
+# Bug #42977 RBR logs for rows with more than 250 column results
+#            in corrupt binlog 
+##################################################################
+
+-- source include/master-slave.inc
+-- source include/have_binlog_format_row.inc
+
+--disable_warnings
+DROP TABLE IF EXISTS t300;
+--enable_warnings
+
+connection master;
+
+create table t300 (
+f1 int,
+f2 int,
+f3 int,
+f4 int,
+f5 int,
+f6 int,
+f7 int,
+f8 int,
+f9 int,
+f10 int,
+f11 int,
+f12 int,
+f13 int,
+f14 int,
+f15 int,
+f16 int,
+f17 int,
+f18 int,
+f19 int,
+f20 int,
+f21 int,
+f22 int,
+f23 int,
+f24 int,
+f25 int,
+f26 int,
+f27 int,
+f28 int,
+f29 int,
+f30 int,
+f31 int,
+f32 int,
+f33 int,
+f34 int,
+f35 int,
+f36 int,
+f37 int,
+f38 int,
+f39 int,
+f40 int,
+f41 int,
+f42 int,
+f43 int,
+f44 int,
+f45 int,
+f46 int,
+f47 int,
+f48 int,
+f49 int,
+f50 int,
+f51 int,
+f52 int,
+f53 int,
+f54 int,
+f55 int,
+f56 int,
+f57 int,
+f58 int,
+f59 int,
+f60 int,
+f61 int,
+f62 int,
+f63 int,
+f64 int,
+f65 int,
+f66 int,
+f67 int,
+f68 int,
+f69 int,
+f70 int,
+f71 int,
+f72 int,
+f73 int,
+f74 int,
+f75 int,
+f76 int,
+f77 int,
+f78 int,
+f79 int,
+f80 int,
+f81 int,
+f82 int,
+f83 int,
+f84 int,
+f85 int,
+f86 int,
+f87 int,
+f88 int,
+f89 int,
+f90 int,
+f91 int,
+f92 int,
+f93 int,
+f94 int,
+f95 int,
+f96 int,
+f97 int,
+f98 int,
+f99 int,
+f100 int,
+f101 int,
+f102 int,
+f103 int,
+f104 int,
+f105 int,
+f106 int,
+f107 int,
+f108 int,
+f109 int,
+f110 int,
+f111 int,
+f112 int,
+f113 int,
+f114 int,
+f115 int,
+f116 int,
+f117 int,
+f118 int,
+f119 int,
+f120 int,
+f121 int,
+f122 int,
+f123 int,
+f124 int,
+f125 int,
+f126 int,
+f127 int,
+f128 int,
+f129 int,
+f130 int,
+f131 int,
+f132 int,
+f133 int,
+f134 int,
+f135 int,
+f136 int,
+f137 int,
+f138 int,
+f139 int,
+f140 int,
+f141 int,
+f142 int,
+f143 int,
+f144 int,
+f145 int,
+f146 int,
+f147 int,
+f148 int,
+f149 int,
+f150 int,
+f151 int,
+f152 int,
+f153 int,
+f154 int,
+f155 int,
+f156 int,
+f157 int,
+f158 int,
+f159 int,
+f160 int,
+f161 int,
+f162 int,
+f163 int,
+f164 int,
+f165 int,
+f166 int,
+f167 int,
+f168 int,
+f169 int,
+f170 int,
+f171 int,
+f172 int,
+f173 int,
+f174 int,
+f175 int,
+f176 int,
+f177 int,
+f178 int,
+f179 int,
+f180 int,
+f181 int,
+f182 int,
+f183 int,
+f184 int,
+f185 int,
+f186 int,
+f187 int,
+f188 int,
+f189 int,
+f190 int,
+f191 int,
+f192 int,
+f193 int,
+f194 int,
+f195 int,
+f196 int,
+f197 int,
+f198 int,
+f199 int,
+f200 int,
+f201 int,
+f202 int,
+f203 int,
+f204 int,
+f205 int,
+f206 int,
+f207 int,
+f208 int,
+f209 int,
+f210 int,
+f211 int,
+f212 int,
+f213 int,
+f214 int,
+f215 int,
+f216 int,
+f217 int,
+f218 int,
+f219 int,
+f220 int,
+f221 int,
+f222 int,
+f223 int,
+f224 int,
+f225 int,
+f226 int,
+f227 int,
+f228 int,
+f229 int,
+f230 int,
+f231 int,
+f232 int,
+f233 int,
+f234 int,
+f235 int,
+f236 int,
+f237 int,
+f238 int,
+f239 int,
+f240 int,
+f241 int,
+f242 int,
+f243 int,
+f244 int,
+f245 int,
+f246 int,
+f247 int,
+f248 int,
+f249 int,
+f250 int,
+f251 int,
+f252 int,
+f253 int,
+f254 int,
+f255 int,
+f256 int,
+f257 int,
+f258 int,
+f259 int,
+f260 int,
+f261 int,
+f262 int,
+f263 int,
+f264 int,
+f265 int,
+f266 int,
+f267 int,
+f268 int,
+f269 int,
+f270 int,
+f271 int,
+f272 int,
+f273 int,
+f274 int,
+f275 int,
+f276 int,
+f277 int,
+f278 int,
+f279 int,
+f280 int,
+f281 int,
+f282 int,
+f283 int,
+f284 int,
+f285 int,
+f286 int,
+f287 int,
+f288 int,
+f289 int,
+f290 int,
+f291 int,
+f292 int,
+f293 int,
+f294 int,
+f295 int,
+f296 int,
+f297 int,
+f298 int,
+f299 int,
+f300 int,
+ primary key (f1));
+
+insert into t300 set f1= 1;
+
+sync_slave_with_master;
+
+#
+# prove that slave processed the create as well as the insert
+#
+eval select f300 from t300;
+select count(*) as one from t300;
+
+--echo *** Cleanup  ***
+connection master;
+DROP TABLE t300;
+sync_slave_with_master;
+
+# END of Test Case
+

mysql-test/suite/rpl/t/rpl_temporary.test

@@ -222,4 +222,40 @@ drop table t1;
 # Delete the anonymous users
 source include/delete_anonymous_users.inc;
 
-# End of tests
+
+
+#
+# Bug#43748: crash when non-super user tries to kill the replication threads
+#
+
+--echo -- Bug#43748
+
+--echo -- make a user on the slave that can list but not kill system threads.
+connection slave;
+
+FLUSH PRIVILEGES;
+GRANT USAGE   ON *.* TO user43748@127.0.0.1 IDENTIFIED BY 'meow';
+GRANT PROCESS ON *.* TO user43748@127.0.0.1;
+
+--echo -- try to KILL system-thread as that non-privileged user (on slave).
+connect (cont43748,127.0.0.1,user43748,meow,test,$SLAVE_MYPORT,);
+connection cont43748;
+
+SELECT id INTO @id FROM information_schema.processlist WHERE user='system user' LIMIT 1;
+
+--error ER_KILL_DENIED_ERROR,ER_NO_SUCH_THREAD
+KILL @id;
+
+disconnect cont43748;
+
+--echo -- throw out test-user on slave.
+connection slave;
+
+DROP USER user43748@127.0.0.1;
+
+--echo -- done. back to master.
+connection master;
+
+
+
+--echo End of 5.1 tests

mysql-test/t/archive.test

@@ -1599,18 +1599,3 @@ INSERT INTO t1 VALUES (NULL, NULL),(NULL, NULL);
 FLUSH TABLE t1;
 SELECT * FROM t1 ORDER BY a;
 DROP TABLE t1;
-
---echo #
---echo # BUG#32880 - Repairing Archive table fails with internal error 144
---echo #
---echo 
---echo # Test with an existing table which is corrupted
---echo # Copy t1 from std_data
-let $MYSQLD_DATADIR= `select @@datadir`;
-copy_file std_data/bug32880.frm $MYSQLD_DATADIR/test/t1.frm;
-copy_file std_data/bug32880.ARZ $MYSQLD_DATADIR/test/t1.ARZ;
-copy_file std_data/bug32880.ARN $MYSQLD_DATADIR/test/t1.ARN;
-SHOW CREATE TABLE t1;
-CHECK TABLE t1;
-REPAIR TABLE t1;
-DROP TABLE t1;

mysql-test/t/upgrade.test

@@ -53,7 +53,9 @@ drop table `txu#p#p1`;
 #
 
 let $MYSQLD_DATADIR= `select @@datadir`;
-system cp $MYSQL_TEST_DIR/std_data/old_table-323.frm $MYSQLD_DATADIR/test/t1.frm;
+--error 0,1
+--remove_file $MYSQLD_DATADIR/test/t1.frm
+--copy_file std_data/old_table-323.frm $MYSQLD_DATADIR/test/t1.frm
 truncate t1;
 drop table t1;
 

sql/log_event.cc

@@ -6993,8 +6993,8 @@ int Rows_log_event::get_data_size()
 {
   int const type_code= get_type_code();
 
-  uchar buf[sizeof(m_width)+1];
-  uchar *end= net_store_length(buf, (m_width + 7) / 8);
+  uchar buf[sizeof(m_width) + 1];
+  uchar *end= net_store_length(buf, m_width);
 
   DBUG_EXECUTE_IF("old_row_based_repl_4_byte_map_id_master",
                   return 6 + no_bytes_in_map(&m_cols) + (end - buf) +
@@ -7583,7 +7583,7 @@ bool Rows_log_event::write_data_body(IO_CACHE*file)
      Note that this should be the number of *bits*, not the number of
      bytes.
   */
-  uchar sbuf[sizeof(m_width)];
+  uchar sbuf[sizeof(m_width) + 1];
   my_ptrdiff_t const data_size= m_rows_cur - m_rows_buf;
   bool res= false;
   uchar *const sbuf_end= net_store_length(sbuf, (size_t) m_width);
@@ -7745,6 +7745,8 @@ Table_map_log_event::Table_map_log_event(THD *thd, TABLE *tbl, ulong tid,
     m_null_bits(0),
     m_meta_memory(NULL)
 {
+  uchar cbuf[sizeof(m_colcnt) + 1];
+  uchar *cbuf_end;
   DBUG_ASSERT(m_table_id != ~0UL);
   /*
     In TABLE_SHARE, "db" and "table_name" are 0-terminated (see this comment in
@@ -7761,7 +7763,9 @@ Table_map_log_event::Table_map_log_event(THD *thd, TABLE *tbl, ulong tid,
   DBUG_EXECUTE_IF("old_row_based_repl_4_byte_map_id_master", m_data_size= 6;);
   m_data_size+= m_dblen + 2;	// Include length and terminating \0
   m_data_size+= m_tbllen + 2;	// Include length and terminating \0
-  m_data_size+= 1 + m_colcnt;	// COLCNT and column types
+  cbuf_end= net_store_length(cbuf, (size_t) m_colcnt);
+  DBUG_ASSERT(static_cast<size_t>(cbuf_end - cbuf) <= sizeof(cbuf));
+  m_data_size+= (cbuf_end - cbuf) + m_colcnt;	// COLCNT and column types
 
   /* If malloc fails, caught in is_valid() */
   if ((m_memory= (uchar*) my_malloc(m_colcnt, MYF(MY_WME))))
@@ -8053,7 +8057,7 @@ bool Table_map_log_event::write_data_body(IO_CACHE *file)
   uchar const dbuf[]= { (uchar) m_dblen };
   uchar const tbuf[]= { (uchar) m_tbllen };
 
-  uchar cbuf[sizeof(m_colcnt)];
+  uchar cbuf[sizeof(m_colcnt) + 1];
   uchar *const cbuf_end= net_store_length(cbuf, (size_t) m_colcnt);
   DBUG_ASSERT(static_cast<size_t>(cbuf_end - cbuf) <= sizeof(cbuf));
 

sql/rpl_utility.h

@@ -294,12 +294,14 @@ namespace {
 }
 #endif
 
+// NB. number of printed bit values is limited to sizeof(buf) - 1
 #define DBUG_PRINT_BITSET(N,FRM,BS)                \
   do {                                             \
     char buf[256];                                 \
-    for (uint i = 0 ; i < (BS)->n_bits ; ++i)      \
+    uint i;                                        \
+    for (i = 0 ; i < min(sizeof(buf) - 1, (BS)->n_bits) ; i++) \
       buf[i] = bitmap_is_set((BS), i) ? '1' : '0'; \
-    buf[(BS)->n_bits] = '\0';                      \
+    buf[i] = '\0';                                 \
     DBUG_PRINT((N), ((FRM), buf));                 \
   } while (0)
 

sql/sp_head.cc

@@ -956,6 +956,8 @@ subst_spvars(THD *thd, sp_instr *instr, LEX_STRING *query_str)
   qbuf.length(0);
   cur= query_str->str;
   prev_pos= res= 0;
+  thd->query_name_consts= 0;
+  
   for (Item_splocal **splocal= sp_vars_uses.front(); 
        splocal < sp_vars_uses.back(); splocal++)
   {
@@ -989,6 +991,8 @@ subst_spvars(THD *thd, sp_instr *instr, LEX_STRING *query_str)
     res|= qbuf.append(')');
     if (res)
       break;
+      
+    thd->query_name_consts++;
   }
   res|= qbuf.append(cur + prev_pos, query_str->length - prev_pos);
   if (res)
@@ -2853,6 +2857,7 @@ sp_instr_stmt::execute(THD *thd, uint *nextp)
       *nextp= m_ip+1;
     thd->query= query;
     thd->query_length= query_length;
+    thd->query_name_consts= 0;
 
     if (!thd->is_error())
       thd->main_da.reset_diagnostics_area();

sql/sql_class.cc

@@ -599,6 +599,7 @@ THD::THD()
   one_shot_set= 0;
   file_id = 0;
   query_id= 0;
+  query_name_consts= 0;
   warn_id= 0;
   db_charset= global_system_variables.collation_database;
   bzero(ha_data, sizeof(ha_data));
@@ -2805,6 +2806,14 @@ Security_context::restore_security_context(THD *thd,
 }
 #endif
 
+
+bool Security_context::user_matches(Security_context *them)
+{
+  return ((user != NULL) && (them->user != NULL) &&
+          !strcmp(user, them->user));
+}
+
+
 /****************************************************************************
   Handling of open and locked tables states.
 

sql/sql_class.h

@@ -813,6 +813,7 @@ public:
   void
   restore_security_context(THD *thd, Security_context *backup);
 #endif
+  bool user_matches(Security_context *);
 };
 
 
@@ -1774,6 +1775,9 @@ public:
   sp_cache   *sp_proc_cache;
   sp_cache   *sp_func_cache;
 
+  /** number of name_const() substitutions, see sp_head.cc:subst_spvars() */
+  uint       query_name_consts;
+
   /*
     If we do a purge of binary logs, log index info of the threads
     that are currently reading it needs to be adjusted. To do that

sql/sql_parse.cc

@@ -2558,6 +2558,43 @@ mysql_execute_command(THD *thd)
     {
       select_result *result;
 
+      /*
+        If:
+        a) we inside an SP and there was NAME_CONST substitution,
+        b) binlogging is on (STMT mode),
+        c) we log the SP as separate statements
+        raise a warning, as it may cause problems
+        (see 'NAME_CONST issues' in 'Binary Logging of Stored Programs')
+       */
+      if (thd->query_name_consts && 
+          mysql_bin_log.is_open() &&
+          thd->variables.binlog_format == BINLOG_FORMAT_STMT &&
+          !mysql_bin_log.is_query_in_union(thd, thd->query_id))
+      {
+        List_iterator_fast<Item> it(select_lex->item_list);
+        Item *item;
+        uint splocal_refs= 0;
+        /* Count SP local vars in the top-level SELECT list */
+        while ((item= it++))
+        {
+          if (item->is_splocal())
+            splocal_refs++;
+        }
+        /*
+          If it differs from number of NAME_CONST substitution applied,
+          we may have a SOME_FUNC(NAME_CONST()) in the SELECT list,
+          that may cause a problem with binary log (see BUG#35383),
+          raise a warning. 
+        */
+        if (splocal_refs != thd->query_name_consts)
+          push_warning(thd, 
+                       MYSQL_ERROR::WARN_LEVEL_WARN,
+                       ER_UNKNOWN_ERROR,
+"Invoked routine ran a statement that may cause problems with "
+"binary log, see 'NAME_CONST issues' in 'Binary Logging of Stored Programs' "
+"section of the manual.");
+      }
+      
       select_lex->options|= SELECT_NO_UNLOCK;
       unit->set_limit(select_lex);
 
@@ -6890,8 +6927,26 @@ uint kill_one_thread(THD *thd, ulong id, bool only_kill_query)
   VOID(pthread_mutex_unlock(&LOCK_thread_count));
   if (tmp)
   {
+
+    /*
+      If we're SUPER, we can KILL anything, including system-threads.
+      No further checks.
+
+      KILLer: thd->security_ctx->user could in theory be NULL while
+      we're still in "unauthenticated" state. This is a theoretical
+      case (the code suggests this could happen, so we play it safe).
+
+      KILLee: tmp->security_ctx->user will be NULL for system threads.
+      We need to check so Jane Random User doesn't crash the server
+      when trying to kill a) system threads or b) unauthenticated users'
+      threads (Bug#43748).
+
+      If user of both killer and killee are non-NULL, proceed with
+      slayage if both are string-equal.
+    */
+
     if ((thd->security_ctx->master_access & SUPER_ACL) ||
-	!strcmp(thd->security_ctx->user, tmp->security_ctx->user))
+        thd->security_ctx->user_matches(tmp->security_ctx))
     {
       tmp->awake(only_kill_query ? THD::KILL_QUERY : THD::KILL_CONNECTION);
       error=0;

storage/archive/ha_archive.cc

@@ -1071,7 +1071,11 @@ int ha_archive::unpack_row(azio_stream *file_to_read, uchar *record)
   row_len=  uint4korr(size_buffer);
   DBUG_PRINT("ha_archive",("Unpack row length %u -> %u", row_len, 
                            (unsigned int)table->s->reclength));
-  fix_rec_buff(row_len);
+
+  if (fix_rec_buff(row_len))
+  {
+    DBUG_RETURN(HA_ERR_OUT_OF_MEM);
+  }
   DBUG_ASSERT(row_len <= record_buffer->length);
 
   read= azread(file_to_read, record_buffer->buffer, row_len, &error);