Fix compiler warnings (detected by Intel's C++ compiler)

Fixed checking of privilege handling in CREATE ... SELECT (Bug #6094)

client/mysql.cc

@@ -1971,7 +1971,7 @@ print_field_types(MYSQL_RES *result)
   MYSQL_FIELD	*field;  
   while ((field = mysql_fetch_field(result)))
   {
-    tee_fprintf(PAGER,"Catalog:    '%s'\nDatabase:   '%s'\nTable:      '%s'\nName:       '%s'\nType:       %d\nLength:     %d\nMax length: %d\nIs_null:    %d\nFlags:      %d\nDecimals:   %d\n\n",
+    tee_fprintf(PAGER,"Catalog:    '%s'\nDatabase:   '%s'\nTable:      '%s'\nName:       '%s'\nType:       %d\nLength:     %ld\nMax length: %ld\nIs_null:    %d\nFlags:      %u\nDecimals:   %u\n\n",
 		field->catalog, field->db, field->table, field->name,
 		(int) field->type,
 		field->length, field->max_length,
@@ -2017,7 +2017,8 @@ print_table_data(MYSQL_RES *result)
     (void) tee_fputs("|", PAGER);
     for (uint off=0; (field = mysql_fetch_field(result)) ; off++)
     {
-      tee_fprintf(PAGER, " %-*s|",min(field->max_length,MAX_COLUMN_LENGTH),
+      tee_fprintf(PAGER, " %-*s|",(int) min(field->max_length,
+                                            MAX_COLUMN_LENGTH),
 		  field->name);
       num_flag[off]= IS_NUM(field->type);
     }

client/mysqltest.c

@@ -359,8 +359,7 @@ DYNAMIC_STRING ds_res;
 static void die(const char *fmt, ...);
 static void init_var_hash();
 static VAR* var_from_env(const char *, const char *);
-static byte* get_var_key(const byte* rec, uint* len,
-			 my_bool __attribute__((unused)) t);
+static byte* get_var_key(const byte* rec, uint* len, my_bool t);
 static VAR* var_init(VAR* v, const char *name, int name_len, const char *val,
 		     int val_len);
 
@@ -1785,6 +1784,10 @@ int read_line(char* buf, int size)
       continue;
     }
 
+    /* Line counting is independent of state */
+    if (c == '\n')
+      (*lineno)++;
+
     switch(state) {
     case R_NORMAL:
       /*  Only accept '{' in the beginning of a line */
@@ -1800,14 +1803,12 @@ int read_line(char* buf, int size)
       else if (c == '\n')
       {
 	state = R_LINE_START;
-	(*lineno)++;
       }
       break;
     case R_COMMENT:
       if (c == '\n')
       {
 	*p= 0;
-	(*lineno)++;
 	DBUG_RETURN(0);
       }
       break;
@@ -1819,7 +1820,7 @@ int read_line(char* buf, int size)
       else if (my_isspace(charset_info, c))
       {
 	if (c == '\n')
-	  start_lineno= ++*lineno;		/* Query hasn't started yet */
+	  start_lineno= *lineno;		/* Query hasn't started yet */
 	no_save= 1;
       }
       else if (c == '}')

heap/hp_hash.c

@@ -585,7 +585,7 @@ uint hp_rb_make_key(HP_KEYDEF *keydef, byte *key,
                               char_length / seg->charset->mbmaxlen);
       set_if_smaller(char_length, seg->length); /* QQ: ok to remove? */
       if (char_length < seg->length)
-        seg->charset->cset->fill(seg->charset, key + char_length, 
+        seg->charset->cset->fill(seg->charset, (char*) key + char_length, 
                                  seg->length - char_length, ' ');
     }
     memcpy(key, rec + seg->start, (size_t) char_length);
@@ -634,7 +634,7 @@ uint hp_rb_pack_key(HP_KEYDEF *keydef, uchar *key, const uchar *old,
                               char_length / seg->charset->mbmaxlen);
       set_if_smaller(char_length, seg->length); /* QQ: ok to remove? */
       if (char_length < seg->length)
-        seg->charset->cset->fill(seg->charset, key + char_length, 
+        seg->charset->cset->fill(seg->charset, (char*) key + char_length, 
                                  seg->length - char_length, ' ');
     }
     memcpy(key, old, (size_t) char_length);

innobase/dict/dict0load.c

@@ -92,7 +92,7 @@ loop:
 
 		/* We found one */
 
-		char*	table_name = mem_strdupl(field, len);
+                char*	table_name = mem_strdupl((char*) field, len);
 		
 		btr_pcur_close(&pcur);
 		mtr_commit(&mtr);
@@ -154,7 +154,7 @@ loop:
 
 		/* We found one */
 
-		char*	table_name = mem_strdupl(field, len);
+                char*	table_name = mem_strdupl((char*) field, len);
 
 		btr_pcur_store_position(&pcur, &mtr);
 
@@ -246,7 +246,7 @@ loop:
 
 		/* We found one */
 
-		char*	name = mem_strdupl(field, len);
+                char*	name = mem_strdupl((char*) field, len);
 
 		field = rec_get_nth_field(rec, 9, &len);
 		ut_a(len == 4);
@@ -347,7 +347,7 @@ dict_load_columns(
 			dict_table_get_first_index(sys_columns), 4))->name));
 
 		field = rec_get_nth_field(rec, 4, &len);
-		name = mem_heap_strdupl(heap, field, len);
+		name = mem_heap_strdupl(heap, (char*) field, len);
 
 		field = rec_get_nth_field(rec, 5, &len);
 		mtype = mach_read_from_4(field);
@@ -494,7 +494,7 @@ dict_load_fields(
 		field = rec_get_nth_field(rec, 4, &len);
 
 		dict_mem_index_add_field(index,
-			mem_heap_strdupl(heap, field, len), 0, prefix_len);
+                                         mem_heap_strdupl(heap, (char*) field, len), 0, prefix_len);
 
 		btr_pcur_move_to_next_user_rec(&pcur, &mtr);
 	} 
@@ -597,7 +597,7 @@ dict_load_indexes(
 			dict_table_get_first_index(sys_indexes), 4))->name));
 		
 		field = rec_get_nth_field(rec, 4, &name_len);
-		name_buf = mem_heap_strdupl(heap, field, name_len);
+		name_buf = mem_heap_strdupl(heap, (char*) field, name_len);
 
 		field = rec_get_nth_field(rec, 5, &len);
 		n_fields = mach_read_from_4(field);
@@ -805,7 +805,7 @@ dict_load_table(
 		table->mix_id = mach_read_from_8(field);
 
 		field = rec_get_nth_field(rec, 8, &len);
-		table->cluster_name = mem_heap_strdupl(heap, field, len);
+		table->cluster_name = mem_heap_strdupl(heap, (char*) field, len);
 #endif
 	}
 
@@ -938,7 +938,7 @@ dict_load_table_on_id(
 	/* Now we get the table name from the record */
 	field = rec_get_nth_field(rec, 1, &len);
 	/* Load the table definition to memory */
-	table = dict_load_table(mem_heap_strdupl(heap, field, len));
+	table = dict_load_table(mem_heap_strdupl(heap, (char*) field, len));
 	
 	btr_pcur_close(&pcur);
 	mtr_commit(&mtr);
@@ -1030,11 +1030,11 @@ dict_load_foreign_cols(
 
 		field = rec_get_nth_field(rec, 4, &len);
 		foreign->foreign_col_names[i] =
-			mem_heap_strdupl(foreign->heap, field, len);
+                        mem_heap_strdupl(foreign->heap, (char*) field, len);
 
 		field = rec_get_nth_field(rec, 5, &len);
 		foreign->referenced_col_names[i] =
-			mem_heap_strdupl(foreign->heap, field, len);
+                  mem_heap_strdupl(foreign->heap, (char*) field, len);
 
 		btr_pcur_move_to_next_user_rec(&pcur, &mtr);
 	} 
@@ -1138,11 +1138,11 @@ dict_load_foreign(
 
 	field = rec_get_nth_field(rec, 3, &len);
 	foreign->foreign_table_name =
-		mem_heap_strdupl(foreign->heap, field, len);
+                mem_heap_strdupl(foreign->heap, (char*) field, len);
 	
 	field = rec_get_nth_field(rec, 4, &len);
 	foreign->referenced_table_name =
-		mem_heap_strdupl(foreign->heap, field, len);
+                mem_heap_strdupl(foreign->heap, (char*) field, len);
 
 	btr_pcur_close(&pcur);
 	mtr_commit(&mtr);
@@ -1256,7 +1256,7 @@ loop:
 
 	/* Now we get a foreign key constraint id */
 	field = rec_get_nth_field(rec, 1, &len);
-	id = mem_heap_strdupl(heap, field, len);
+	id = mem_heap_strdupl(heap, (char*) field, len);
 	
 	btr_pcur_store_position(&pcur, &mtr);
 

innobase/include/mem0mem.h

@@ -136,10 +136,8 @@ void
 mem_heap_free_func(
 /*===============*/
 	mem_heap_t*   	heap,  		/* in, own: heap to be freed */
-	const char*	file_name __attribute__((unused)),
-					/* in: file name where freed */
-	ulint    	line  __attribute__((unused)));
-					/* in: line where freed */
+	const char*	file_name, 	/* in: file name where freed */
+	ulint    	line);		/* in: line where freed */
 /*******************************************************************
 Allocates n bytes of memory from a memory heap. */
 UNIV_INLINE

libmysql/client_settings.h

@@ -21,7 +21,7 @@ extern my_string	mysql_unix_port;
                              CLIENT_TRANSACTIONS | \
 			     CLIENT_PROTOCOL_41 | CLIENT_SECURE_CONNECTION)
 
-sig_handler pipe_sig_handler(int sig __attribute__((unused)));
+sig_handler pipe_sig_handler(int sig);
 void read_user_name(char *name);
 my_bool handle_local_infile(MYSQL *mysql, const char *net_filename);
 

myisam/ft_nlq_search.c

@@ -99,6 +99,7 @@ static int walk_and_match(FT_WORD *word, uint32 count, ALL_IN_ONE *aio)
 
   info->update|= HA_STATE_AKTIV;              /* for _mi_test_if_changed() */
 
+  /* The following should be safe, even if we compare doubles */
   while (!r && gweight)
   {
 
@@ -127,6 +128,7 @@ static int walk_and_match(FT_WORD *word, uint32 count, ALL_IN_ONE *aio)
 #else
 #error
 #endif
+  /* The following should be safe, even if we compare doubles */
     if (tmp_weight==0)
       DBUG_RETURN(doc_cnt); /* stopword, doc_cnt should be 0 */
 

myisam/rt_index.c

@@ -494,9 +494,11 @@ static uchar *rtree_pick_key(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *key,
 
   for (; k < last; k = rt_PAGE_NEXT_KEY(k, key_length, nod_flag))
   {
+    /* The following is safe as -1.0 is an exact number */
     if ((increase = rtree_area_increase(keyinfo->seg, k, key, key_length, 
-                                        &area)) == -1)
+                                        &area)) == -1.0)
       return NULL;
+    /* The following should be safe, even if we compare doubles */
     if (increase < best_incr)
     {
       best_key = k;
@@ -505,6 +507,7 @@ static uchar *rtree_pick_key(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *key,
     }
     else
     {
+      /* The following should be safe, even if we compare doubles */
       if ((increase == best_incr) && (area < best_area))
       {
         best_key = k;
@@ -1021,6 +1024,7 @@ ha_rows rtree_estimate(MI_INFO *info, uint keynr, uchar *key,
     {
       double k_area = rtree_rect_volume(keyinfo->seg, k, key_length);
 
+      /* The following should be safe, even if we compare doubles */
       if (k_area == 0)
       {
         if (flag & (MBR_CONTAIN | MBR_INTERSECT))

myisam/rt_mbr.c

@@ -129,6 +129,7 @@ int rtree_key_cmp(HA_KEYSEG *keyseg, uchar *b, uchar *a, uint key_length,
       break;
 #endif
     case HA_KEYTYPE_FLOAT:
+      /* The following should be safe, even if we compare doubles */
       RT_CMP_GET(float, mi_float4get, 4, nextflag);
       break;
     case HA_KEYTYPE_DOUBLE:

mysql-test/r/ps.result

@@ -410,3 +410,17 @@ a	a
 1.1	1.2
 2.1	2.2
 deallocate prepare stmt;
+create table t1 (a int);
+insert into t1 values (1),(2),(3);
+create table t2 select * from t1;
+PREPARE my_stmt FROM 'create table t2 select * from t1';
+drop table t2;
+execute my_stmt;
+drop table t2;
+execute my_stmt;
+execute my_stmt;
+ERROR 42S01: Table 't2' already exists
+drop table t2;
+execute my_stmt;
+drop table t1,t2;
+deallocate prepare my_stmt;

mysql-test/t/ps.test

@@ -415,3 +415,21 @@ execute stmt;
 execute stmt;
 execute stmt;
 deallocate prepare stmt;
+
+#
+# Test CREATE TABLE ... SELECT (Bug #6094)
+#
+create table t1 (a int); 
+insert into t1 values (1),(2),(3);
+create table t2 select * from t1;
+PREPARE my_stmt FROM 'create table t2 select * from t1';
+drop table t2;
+execute my_stmt;
+drop table t2;
+execute my_stmt;
+--error 1050
+execute my_stmt;
+drop table t2;
+execute my_stmt;
+drop table t1,t2;
+deallocate prepare my_stmt;

mysys/hash.c

@@ -174,6 +174,7 @@ static uint hash_rec_mask(HASH *hash,HASH_LINK *pos,uint buffmax,
 
 
 /* for compilers which can not handle inline */
+static
 #if !defined(__SUNPRO_C) && !defined(__USLC__) && !defined(__sgi)
 inline
 #endif

mysys/my_handler.c

@@ -309,6 +309,11 @@ int ha_key_cmp(register HA_KEYSEG *keyseg, register uchar *a,
     case HA_KEYTYPE_FLOAT:
       mi_float4get(f_1,a);
       mi_float4get(f_2,b);
+      /*
+        The following may give a compiler warning about floating point
+        comparison not being safe, but this is ok in this context as
+        we are bascily doing sorting
+      */
       if (piks && (flag = CMP_NUM(f_1,f_2)))
         return ((keyseg->flag & HA_REVERSE_SORT) ? -flag : flag);
       a=  end;
@@ -317,6 +322,11 @@ int ha_key_cmp(register HA_KEYSEG *keyseg, register uchar *a,
     case HA_KEYTYPE_DOUBLE:
       mi_float8get(d_1,a);
       mi_float8get(d_2,b);
+      /*
+        The following may give a compiler warning about floating point
+        comparison not being safe, but this is ok in this context as
+        we are bascily doing sorting
+      */
       if (piks && (flag = CMP_NUM(d_1,d_2)))
         return ((keyseg->flag & HA_REVERSE_SORT) ? -flag : flag);
       a=  end;

mysys/my_thr_init.c

@@ -64,6 +64,11 @@ my_bool my_thread_global_init(void)
   }
 #ifdef PTHREAD_ADAPTIVE_MUTEX_INITIALIZER_NP
   pthread_mutexattr_init(&my_fast_mutexattr);
+  /*
+    Note that the following statement may give a compiler warning under
+    some configurations, but there isn't anything we can do about this as
+    this is a bug in the header files for the thread implementation
+  */
   pthread_mutexattr_setkind_np(&my_fast_mutexattr,PTHREAD_MUTEX_ADAPTIVE_NP);
 #endif
 #ifdef PTHREAD_ERRORCHECK_MUTEX_INITIALIZER_NP

ndb/include/mgmapi/mgmapi.h

@@ -271,7 +271,7 @@ extern "C" {
    *   Log categories
    */
   enum ndb_mgm_event_category {
-    NDB_MGM_ILLEGAL_EVENT_CATEGORY = -1,     /*< Invalid
+    NDB_MGM_ILLEGAL_EVENT_CATEGORY = -1,
     /**
      * Events during all kinds of startups
      */

regex/main.c

@@ -78,7 +78,7 @@ char *argv[];
 	if (err) {
 		len = regerror(err, &re, erbuf, sizeof(erbuf));
 		fprintf(stderr, "error %s, %d/%d `%s'\n",
-			eprint(err), len, sizeof(erbuf), erbuf);
+			eprint(err), len, (int) sizeof(erbuf), erbuf);
 		exit(status);
 	}
 	regprint(&re, stdout);
@@ -96,7 +96,7 @@ char *argv[];
 	if (err) {
 		len = regerror(err, &re, erbuf, sizeof(erbuf));
 		fprintf(stderr, "error %s, %d/%d `%s'\n",
-			eprint(err), len, sizeof(erbuf), erbuf);
+			eprint(err), (int) len, (int) sizeof(erbuf), erbuf);
 		exit(status);
 	}
 	if (!(copts&REG_NOSUB)) {
@@ -232,7 +232,7 @@ int opts;			/* may not match f1 */
 		len = regerror(err, &re, erbuf, sizeof(erbuf));
 		fprintf(stderr, "%d: %s error %s, %d/%d `%s'\n",
 					line, type, eprint(err), len,
-					sizeof(erbuf), erbuf);
+					(int) sizeof(erbuf), erbuf);
 		status = 1;
 	} else if (err == 0 && opt('C', f1)) {
 		/* unexpected success */
@@ -263,7 +263,7 @@ int opts;			/* may not match f1 */
 		len = regerror(err, &re, erbuf, sizeof(erbuf));
 		fprintf(stderr, "%d: %s exec error %s, %d/%d `%s'\n",
 					line, type, eprint(err), len,
-					sizeof(erbuf), erbuf);
+					(int) sizeof(erbuf), erbuf);
 		status = 1;
 	} else if (err != 0) {
 		/* nothing more to check */

sql/item.h

@@ -97,7 +97,8 @@ public:
   static void *operator new(size_t size) {return (void*) sql_alloc((uint) size); }
   static void *operator new(size_t size, MEM_ROOT *mem_root)
   { return (void*) alloc_root(mem_root, (uint) size); }
-  static void operator delete(void *ptr,size_t size) {} /*lint -e715 */
+  static void operator delete(void *ptr,size_t size) {}
+  static void operator delete(void *ptr,size_t size, MEM_ROOT *mem_root) {}
 
   enum Type {FIELD_ITEM, FUNC_ITEM, SUM_FUNC_ITEM, STRING_ITEM,
 	     INT_ITEM, REAL_ITEM, NULL_ITEM, VARBIN_ITEM,

sql/item_func.h

@@ -348,6 +348,7 @@ class Item_dec_func :public Item_real_func
 #ifndef HAVE_FINITE
     return value;
 #else
+    /* The following should be safe, even if we compare doubles */
     if (finite(value) && value != POSTFIX_ERROR)
       return value;
     null_value=1;
@@ -1032,6 +1033,7 @@ public:
   table_map not_null_tables() const { return 0; }
   bool fix_fields(THD *thd, struct st_table_list *tlist, Item **ref);
   bool eq(const Item *, bool binary_cmp) const;
+  /* The following should be safe, even if we compare doubles */
   longlong val_int() { DBUG_ASSERT(fixed == 1); return val()!=0.0; }
   double val();
   void print(String *str);

sql/spatial.h

@@ -97,12 +97,14 @@ struct MBR
 
   int equals(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((mbr->xmin == xmin) && (mbr->ymin == ymin) &&
 	    (mbr->xmax == xmax) && (mbr->ymax == ymax));
   }
 
   int disjoint(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((mbr->xmin > xmax) || (mbr->ymin > ymax) ||
 	    (mbr->xmax < xmin) || (mbr->ymax < ymin));
   }
@@ -114,6 +116,7 @@ struct MBR
 
   int touches(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((((mbr->xmin == xmax) || (mbr->xmax == xmin)) && 
 	     ((mbr->ymin >= ymin) && (mbr->ymin <= ymax) || 
 	      (mbr->ymax >= ymin) && (mbr->ymax <= ymax))) ||
@@ -124,18 +127,21 @@ struct MBR
 
   int within(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((mbr->xmin <= xmin) && (mbr->ymin <= ymin) &&
 	    (mbr->xmax >= xmax) && (mbr->ymax >= ymax));
   }
 
   int contains(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((mbr->xmin >= xmin) && (mbr->ymin >= ymin) &&
 	    (mbr->xmax <= xmax) && (mbr->ymax <= ymax));
   }
 
   bool inner_point(double x, double y) const
   {
+    /* The following should be safe, even if we compare doubles */
     return (xmin<x) && (xmax>x) && (ymin<y) && (ymax>x);
   }
 
@@ -164,6 +170,9 @@ public:
     return buffer;
   }
 
+  static void operator delete(void *ptr, void *buffer)
+  {}
+
   enum wkbType
   {
     wkb_point= 1,

sql/sql_lex.h

@@ -241,6 +241,7 @@ public:
   static void *operator new(size_t size, MEM_ROOT *mem_root)
   { return (void*) alloc_root(mem_root, (uint) size); }
   static void operator delete(void *ptr,size_t size) {}
+  static void operator delete(void *ptr,size_t size, MEM_ROOT *mem_root) {}
   st_select_lex_node(): linkage(UNSPECIFIED_TYPE) {}
   virtual ~st_select_lex_node() {}
   inline st_select_lex_node* get_master() { return master; }

sql/sql_list.h

@@ -41,6 +41,8 @@ public:
   static void *operator new(size_t size, MEM_ROOT *mem_root)
   { return (void*) alloc_root(mem_root, (uint) size); }
   static void operator delete(void *ptr, size_t size) { TRASH(ptr, size); }
+  static void operator delete(void *ptr, size_t size, MEM_ROOT *mem_root)
+  { TRASH(ptr, size); }
   static void operator delete[](void *ptr, size_t size) { TRASH(ptr, size); }
 #ifdef HAVE_purify
   bool dummy;

sql/sql_parse.cc

@@ -1862,8 +1862,8 @@ mysql_execute_command(THD *thd)
 {
   int	res= 0;
   LEX	*lex= thd->lex;
-  TABLE_LIST *tables= (TABLE_LIST*) lex->select_lex.table_list.first;
   SELECT_LEX *select_lex= &lex->select_lex;
+  TABLE_LIST *tables= (TABLE_LIST*) select_lex->table_list.first;
   SELECT_LEX_UNIT *unit= &lex->unit;
   DBUG_ENTER("mysql_execute_command");
 
@@ -2333,30 +2333,6 @@ mysql_execute_command(THD *thd)
     {
       select_result *result;
 
-      if (!(lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) &&
-	  find_real_table_in_list(tables, create_table->db,
-				  create_table->real_name))
-      {
-	net_printf(thd,ER_UPDATE_TABLE_USED, create_table->real_name);
-	goto create_error;
-      }
-      if (lex->create_info.used_fields & HA_CREATE_USED_UNION)
-      {
-        TABLE_LIST *tab;
-        for (tab= tables; tab; tab= tab->next)
-        {
-          if (find_real_table_in_list((TABLE_LIST*) lex->create_info.
-                                      merge_list.first,
-                                      tables->db, tab->real_name))
-          {
-            net_printf(thd, ER_UPDATE_TABLE_USED, tab->real_name);
-            goto create_error;
-          }
-        }  
-      }    
-
-      if (tables && check_table_access(thd, SELECT_ACL, tables,0))
-	goto create_error;			// Error message is given
       select_lex->options|= SELECT_NO_UNLOCK;
       unit->offset_limit_cnt= select_lex->offset_limit;
       unit->select_limit_cnt= select_lex->select_limit+
@@ -5282,7 +5258,7 @@ int multi_delete_precheck(THD *thd, TABLE_LIST *tables, uint *table_count)
   INSERT ... SELECT query pre-check
 
   SYNOPSIS
-    multi_delete_precheck()
+    insert_delete_precheck()
     thd		Thread handler
     tables	Global table list
 
@@ -5404,26 +5380,69 @@ int insert_precheck(THD *thd, TABLE_LIST *tables)
   RETURN VALUE
     0   OK
     1   Error (message is sent to user)
-    -1  Error (message is not sent to user)
 */
 
 int create_table_precheck(THD *thd, TABLE_LIST *tables,
 			  TABLE_LIST *create_table)
 {
   LEX *lex= thd->lex;
+  SELECT_LEX *select_lex= &lex->select_lex;
+  ulong want_priv;
+  int error= 1;                                 // Error message is given
   DBUG_ENTER("create_table_precheck");
-  ulong want_priv= ((lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) ?
-		    CREATE_TMP_ACL : CREATE_ACL);
+
+  want_priv= ((lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) ?
+              CREATE_TMP_ACL : CREATE_ACL);
   lex->create_info.alias= create_table->alias;
   if (check_access(thd, want_priv, create_table->db,
 		   &create_table->grant.privilege, 0, 0) ||
       check_merge_table_access(thd, create_table->db,
 			       (TABLE_LIST *)
 			       lex->create_info.merge_list.first))
-    DBUG_RETURN(1);
-  DBUG_RETURN((grant_option && want_priv != CREATE_TMP_ACL &&
-	       check_grant(thd, want_priv, create_table, 0, UINT_MAX, 0)) ?
-	      1 : 0);
+    goto err;
+  if (grant_option && want_priv != CREATE_TMP_ACL &&
+      check_grant(thd, want_priv, create_table, 0, UINT_MAX, 0))
+    goto err;
+
+  if (select_lex->item_list.elements)
+  {
+    /* Check permissions for used tables in CREATE TABLE ... SELECT */
+
+    /*
+      For temporary tables or PREPARED STATEMETNS we don't have to check
+      if the created table exists
+    */
+    if (!(lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) &&
+        ! thd->current_arena->is_stmt_prepare() &&
+        find_real_table_in_list(tables, create_table->db,
+                                create_table->real_name))
+    {
+      net_printf(thd,ER_UPDATE_TABLE_USED, create_table->real_name);
+
+      goto err;
+    }
+    if (lex->create_info.used_fields & HA_CREATE_USED_UNION)
+    {
+      TABLE_LIST *tab;
+      for (tab= tables; tab; tab= tab->next)
+      {
+        if (find_real_table_in_list((TABLE_LIST*) lex->create_info.
+                                    merge_list.first,
+                                    tables->db, tab->real_name))
+        {
+          net_printf(thd, ER_UPDATE_TABLE_USED, tab->real_name);
+          goto err;
+        }
+      }  
+    }    
+
+    if (tables && check_table_access(thd, SELECT_ACL, tables,0))
+      goto err;
+  }
+  error= 0;
+
+err:
+  DBUG_RETURN(error);
 }
 
 

sql/sql_prepare.cc

@@ -1391,7 +1391,6 @@ static int send_prepare_results(Prepared_statement *stmt, bool text_protocol)
       lex->unit.create_total_list(thd, lex, &tables))
     DBUG_RETURN(1);
 
-  
   switch (sql_command) {
   case SQLCOM_REPLACE:
   case SQLCOM_INSERT:

sql/sql_string.h

@@ -71,7 +71,9 @@ public:
   }
   static void *operator new(size_t size, MEM_ROOT *mem_root)
   { return (void*) alloc_root(mem_root, (uint) size); }
-  static void operator delete(void *ptr_arg,size_t size) /*lint -e715 */
+  static void operator delete(void *ptr_arg,size_t size)
+    {}
+  static void operator delete(void *ptr_arg,size_t size, MEM_ROOT *mem_root)
     {}
   ~String() { free(); }
 

strings/ctype-mb.c

@@ -502,7 +502,8 @@ my_bool my_like_range_mb(CHARSET_INFO *cs,
         representation of the max_sort_char character,
         and copy it into max_str in a loop. 
       */
-      buflen= cs->cset->wc_mb(cs, cs->max_sort_char, buf, buf + sizeof(buf));
+      buflen= cs->cset->wc_mb(cs, cs->max_sort_char, (uchar*) buf,
+                              (uchar*) buf + sizeof(buf));
       DBUG_ASSERT(buflen > 0);
       do
       {