manual merge from mysql-5.1-security

mysql-test/suite/innodb/r/innodb_mysql.result

@@ -2538,6 +2538,14 @@ ORDER BY f1 DESC LIMIT 5;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	t1	range	f2,f4	f4	1	NULL	11	Using where
 DROP TABLE t1;
+#
+# Bug#54117 crash in thr_multi_unlock, temporary table
+#
+CREATE TEMPORARY TABLE t1(a INT) ENGINE = InnoDB;
+LOCK TABLES t1 READ;
+ALTER TABLE t1 COMMENT 'test';
+UNLOCK TABLES;
+DROP TABLE t1;
 End of 5.1 tests
 #
 # Test for bug #39932 "create table fails if column for FK is in different

mysql-test/suite/innodb/t/innodb_mysql.test

@@ -737,6 +737,20 @@ ORDER BY f1 DESC LIMIT 5;
 
 DROP TABLE t1;
 
+
+--echo #
+--echo # Bug#54117 crash in thr_multi_unlock, temporary table
+--echo #
+
+CREATE TEMPORARY TABLE t1(a INT) ENGINE = InnoDB;
+
+LOCK TABLES t1 READ;
+ALTER TABLE t1 COMMENT 'test';
+UNLOCK TABLES;
+
+DROP TABLE t1;
+
+
 --echo End of 5.1 tests
 
 

sql/sql_table.cc

@@ -7331,13 +7331,23 @@ bool mysql_alter_table(THD *thd,char *new_db, char *new_name,
   if (table->s->tmp_table != NO_TMP_TABLE)
   {
     /* Close lock if this is a transactional table */
-    if (thd->lock &&
-        ! (thd->locked_tables_mode == LTM_LOCK_TABLES ||
-           thd->locked_tables_mode == LTM_PRELOCKED_UNDER_LOCK_TABLES))
+    if (thd->lock)
+    {
+      if (thd->locked_tables_mode != LTM_LOCK_TABLES &&
+          thd->locked_tables_mode != LTM_PRELOCKED_UNDER_LOCK_TABLES)
       {
         mysql_unlock_tables(thd, thd->lock);
         thd->lock=0;
       }
+      else
+      {
+        /*
+          If LOCK TABLES list is not empty and contains this table,
+          unlock the table and remove the table from this list.
+        */
+        mysql_lock_remove(thd, thd->lock, table);
+      }
+    }
     /* Remove link to old table and rename the new one */
     close_temporary_table(thd, table, 1, 1);
     /* Should pass the 'new_name' as we store table name in the cache */