1. 11 Jan, 2013 1 commit
    • Aditya A's avatar
      Bug#15843818 PARTITIONING BY RANGE WITH TO_DAYS ALWAYS · 21bdf213
      Aditya A authored
                     INCLUDES FIRST PARTITION WHEN PRUNING
      
      
      PROBLEM
      -------
      
      TO_DAYS()/TO_SECONDS() can return NULL for invalid dates which 
      was stored in the first partition ,therefore the first partition 
      was always included for the scan when range was specified.
      
      
      FIX
      ---
      
      The fix is a small optimization which we have included ,which will
      prune the scanning of NULL/first partition if the dates specified 
      in the range are valid and in the same year and month . TO_SECONDS()
      function is not supported in 5.1 so removed it from the fix and test
      scripts for mysql-5.1 version.
      
      21bdf213
  2. 10 Jan, 2013 2 commits
    • Chaithra Gopalareddy's avatar
      Bug#11760726: LEFT JOIN OPTIMIZED INTO JOIN LEADS TO · 8b41f491
      Chaithra Gopalareddy authored
                    INCORRECT RESULTS
      
      This is a backport of fix for Bug#13068506.
      
      mysql-test/r/join_outer.result:
        Added test result for Bug#13068506
      mysql-test/t/join_outer.test:
        Added test case for Bug#13068506
      sql/item.h:
        Implement Item_outer_ref::not_null_tables()
      8b41f491
    • Praveenkumar Hulakund's avatar
      Bug#11749556: DEBUG ASSERTION WHEN ACCESSING A VIEW AND · 5e399d1c
      Praveenkumar Hulakund authored
                    AVAILABLE MEMORY IS TOO LOW 
      
      Analysis:
      ---------
      In function "mysql_make_view", "table->view" is initialized
      after parsing(using File_parser::parse) the view definition.
      If "::parse" function fails then control is moved to label 
      "err:". Here we have assert (table->view == thd->lex). 
      This assert fails if "::parse" function fails, as 
      table->view is not initialized yet.
      
      File_parser::parse fails if data being parsed is incorrect/
      corrupted or when memory allocation fails. In this scenario
      its failing because of failure in memory allocation.
      
      Fix:
      ---------
      In case of failure in function "File_parser::parse", moving
      to label "err:" is incorrect. Modified code to move
      to label "end:".
      5e399d1c
  3. 09 Jan, 2013 1 commit
  4. 08 Jan, 2013 1 commit
  5. 07 Jan, 2013 2 commits
  6. 04 Jan, 2013 2 commits
    • Satya Bodapati's avatar
      Post Fix to Bug#14628410 - ASSERTION `! IS_SET()' FAILED IN · eab9f8f4
      Satya Bodapati authored
      			    DIAGNOSTICS_AREA::SET_OK_STATUS
      
      Test fails on 5.1 valgrind build. This is because of close(-1)
      system call.
      
      Fixed by adding extra checks for valid file descriptor.
      
      Approved by Vasil(Calvin). rb#1792
      eab9f8f4
    • Nirbhay Choubey's avatar
      Bug#16066243 PB2 FAILURES I_MAIN.BUG15912213 AND · 1ef420b8
      Nirbhay Choubey authored
          I_MAIN.CTYPE_UTF8 FOR MACOSX10.6 FOR 5.1
      
      While converting directory name to filename, a
      file separator (FN_LIBCHAR) might get appended
      to the resulting file name. This can result in
      off-by-one error when length of the input string
      is equal to FN_REFLEN. In this case, the terminating
      '\0' gets written beyond the buffer allocated to store
      the result.
      
      Fixed by incrementing the dst buffer size by 1. As
      extra safety, switched to strnmov() and added a debug
      assert to check the length of the input file name.
      
      No test case added as the scenario is already
      covered by the test cases added for bugs in
      the description.
      1ef420b8
  7. 02 Jan, 2013 1 commit
    • Venkatesh Duggirala's avatar
      BUG#11753923-SQL THREAD CRASHES ON DISK FULL · 39323920
      Venkatesh Duggirala authored
      Problem:If Disk becomes full while writing into the binlog,
      then the server instance hangs till someone frees the space.
      After user frees up the disk space, mysql server crashes
      with an assert (m_status != DA_EMPTY)
      
      Analysis: wait_for_free_space is being called in an
      infinite loop i.e., server instance will hang until
      someone frees up the space. So there is no need to
      set status bit in diagnostic area.
      
      Fix: Replace my_error/my_printf_error with
      sql_print_warning() which prints the warning in error log.
      
      include/my_sys.h:
        Provision to call sql_print_warning from mysys files
      mysys/errors.c:
        Replace my_error/my_printf_error with
        sql_print_warning() which prints the warning in error log.
      mysys/my_error.c:
        implementation of my_printf_warning
      mysys/my_write.c:
        Adding logic to break infinite loop in the simulation
      sql/mysqld.cc:
        Provision to call sql_print_warning from mysys files
      39323920
  8. 01 Jan, 2013 1 commit
  9. 29 Dec, 2012 1 commit
  10. 28 Dec, 2012 1 commit
    • Venkatesh Duggirala's avatar
      BUG#14726272- BACKPORT FIX FOR BUG 11746142 TO 5.5 AND 5.1 · ec70b93e
      Venkatesh Duggirala authored
      Details of BUG#11746142: CALLING MYSQLD WHILE ANOTHER 
      INSTANCE IS RUNNING, REMOVES PID FILE
      Fix: Before removing the pid file, ensure it was created
      by the same process, leave it intact otherwise.
      
      sql/mysqld.cc:
        delete_pid_file() introduced, which checks that the pid file
                belongs to the process before removing it
      ec70b93e
  11. 27 Dec, 2012 2 commits
  12. 26 Dec, 2012 2 commits
    • Chaithra Gopalareddy's avatar
      Bug#12347040: MEMORY LEAK IN CONVERT_TZ COULD POSSIBLY CAUSE · fa61c049
      Chaithra Gopalareddy authored
                          DOS ATTACKS
            
      Problem:
      For detailed description, see Bug#42502. This bug is a duplicate
      of Bug#42502. The complete fix for Bug#42502 was not made as
      proposed. Hence the bug still persists.
            
      Fix:
      Make the changes as proposed originally for the bugfix of 42502.
      Which is to remove the allocation of the memory before we actually
      check for any errors.
      
      sql/tztime.cc:
        Remove the double allocation for tz_info
      fa61c049
    • unknown's avatar
      Merge from mysql-5.1.67-release · 5cf9e193
      unknown authored
      5cf9e193
  13. 24 Dec, 2012 2 commits
    • Annamalai Gurusami's avatar
      Fixing a pb2 issue. There is some difference in the output in my local... · 76059a4a
      Annamalai Gurusami authored
      Fixing a pb2 issue.  There is some difference in the output in my local machine and pb2 machines in the explain output.  
      76059a4a
    • Chaithra Gopalareddy's avatar
      Bug#11757005: UNION CONVERTS UNSIGNED MEDIUMINT AND BIGINT · 259a5a30
      Chaithra Gopalareddy authored
                    TO SIGNED
      Problem:
      When we are joining types (of fields) in case of a union, we usually
      upgrade the datatypes to the largest present in the query.
      In case of mediumint, it is not happening.
      Analysis:
      When joined with types LONG and LONGLONG, mediumint should get
      upgraded to LONG and LONGLONG respectively.
      W.r.t the given query, constant '1' will be created as a LONGLONG
      internally and SIGNED flag is enabled. As a result, while combining
      types for the field, LONGLONG along with MEDIUMINT gets converted
      to LONG first. LONG with MEDIUMINT(of the third select) gets converted
      to MEDIUMINT. SIGNED FLAG would be that of the first field's.
      As a result, the final result would be SIGNED MEDIUMINT.
      Fix:
      While joining types, MEDIUMINT with LONGLONG and MEDIUMINT with LONG
      is converted to LONGLONG and LONG respectively. Also, made some 
      changes for FLOAT and DOUBLE.
      
      
      sql/field.cc:
        Changed merge types for MEDIUMINT.
      259a5a30
  14. 20 Dec, 2012 1 commit
  15. 21 Dec, 2012 1 commit
    • prabakaran thirumalai's avatar
      Bug#14627287 THREAD CACHE - BYPASSES PRIVILEGES · 98aaf18b
      prabakaran thirumalai authored
      Analysis:
      When thread cache is enabled, it does not properly initialize
      thd->start_utime when a thread is picked from the thread cache.
      This breaks the quota management mechanism. 
      THD::time_out_user_resource_limits() resets 
      m_user_connect->conn_per_hour to 0 based on thd->start_utime
      
      Fix:
      Initialize start_utime when cached thread is reused.
      
      Notes:
      Enabled back tests which were disabled because of this issue.
      98aaf18b
  16. 18 Dec, 2012 3 commits
    • Vasil Dimov's avatar
      Fix Bug#16000909 MEMORY LEAK, MYSQL_INPLACE_ALTER_TABLE · 0dd066cb
      Vasil Dimov authored
      This is a followup to the fix of
      Bug#14628410 ASSERTION `! IS_SET()' FAILED IN DIAGNOSTICS_AREA::SET_OK_STATUS
      (satya.bodapati@oracle.com-20121213132316-5joz4phltx9yhjs7)
      
      In innobase_mysql_tmpfile(): allocate/open the file after
      the return(-1); statement.
      0dd066cb
    • Ahmad Abdullateef's avatar
      BUG#14727815 - CRASH IN PTHREAD_RWLOCK_WRLOCK/SRW_UNLOCK · febe03c2
      Ahmad Abdullateef authored
                                   IN QUERY CACHE CODE
      
      DESCRIPTION:
      MySQL Server crashes sporadically when Query Caching is on and
      the server has high contention among clients. 
      
      
      ANALYSIS :
      
      Scenario 1:
      In Query_cache::move_by_type() when handling RESULT or its related blocks,
      Write Lock is acquired on its parent Query block. However the next and prev
      pointers are cached in local variables before lock acquisition. In an extremely
      high contention scenario there exists a possibility that
      Query_cache::append_result_data() is operating on the same query block
      and as a consequence might append a new Result block to the end of Result
      blocks Linked List of the Query. This would manipulate the next, prev pointers
      of the Block being processed in move_by_type(), however the local pointers
      still point to previous nodes there by causing Data Corruption leading to crash.
      
      FIX :
      
      Scenario 1:
      The next, prev pointers are now accessed only after Lock acquisition in 
      Query_cache::move_by_type().
      febe03c2
    • Vasil Dimov's avatar
      Fix Bug#13463493 INNODB PLUGIN WERE CHANGED, BUT STILL USE THE · 7bdd8b48
      Vasil Dimov authored
      SAME VERSION NUMBER 1.0.17
      
      Now that InnoDB/InnoDB Plugin is no longer separately developed and
      distributed from the MySQL server it does not need its own version number.
      Thus use the MySQL version instead.
      
      "Removing" the version altogether is not feasible because the config
      variable 'innodb_version' cannot be removed in GA branches.
      
      Reviewed by:	Marko (rb#1751)
      7bdd8b48
  17. 14 Dec, 2012 2 commits
  18. 13 Dec, 2012 3 commits
    • Ravinder Thakur's avatar
      bug#11761752: DO NOT ALLOW USE OF ALTERNATE DATA STREAMS ON NTFS FILESYSTEM. · 2d16c5bd
      Ravinder Thakur authored
      File names with colon are being disallowed because of the Alternate Data 
      Stream (ADS) feature of NTFS that could be misused. ADS allows data to be 
      written to alternate streams of a normal file. The data in alternate 
      streams cannot be seen by normal tools on Windows (explorer, cmd.exe). As 
      a result someone can use this feature to hide large amount of data in 
      alternate streams and admins will have no easy way of figuring out the 
      files that are using that disk space. The fix also disallows ADS in the 
      scenarios where file name is passed as some dynamic variable.
      
      An important thing about the fix is that it DOES NOT disallow ADS file 
      names if they are not dynamic (i.e. if the file is created by using some 
      option that needs local access to the MySQL server, for example error log
      file). The reasoning is that if some MySQL option related to files 
      requires access to the local machine (it is not dynamic), then user can very 
      well create data in ADS by some other means. This fixes only those scenarios 
      which can allow users to create data in ADS over the wire.
      
      File names with colon are being disallowed only on Windows. UNIX 
      (Linux in particular) supports NTFS, but it will not be a common 
      scenario for someone to configure a NTFS file system to store MySQL 
      data on Linux.
      
      Changes in file bug11761752-master.opt are needed due to 
      bug number 15937938.
      2d16c5bd
    • Satya Bodapati's avatar
      Bug#14628410 - ASSERTION `! IS_SET()' FAILED IN DIAGNOSTICS_AREA::SET_OK_STATUS · b0213a2b
      Satya Bodapati authored
      The error code returned from Merge file/Temp file creation functions are
      ignored.
      
      Use the return codes of the row_merge_file_create() and innobase_mysql_tmpfile()
      to return the error to caller if file creation fails.
      
      Approved by Marko. rb#1618
      b0213a2b
    • Harin Vadodaria's avatar
      Bug#15965288: BUFFER OVERFLOW IN YASSL FUNCTION · cbc9373f
      Harin Vadodaria authored
                    DOPROCESSREPLY()
      
      Description: Function DoProcessReply() calls function
                   decrypt_message() in a while loop without
                   performing a check on available buffer
                   space. This can cause buffer overflow and
                   crash the server. This patch is fix provided
                   by Sawtooth to resolve the issue.
      cbc9373f
  19. 12 Dec, 2012 1 commit
  20. 11 Dec, 2012 3 commits
    • Dmitry Lenev's avatar
      Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE · 2e10e7c3
      Dmitry Lenev authored
      ROBUST AGAINST BUGS IN CALLERS".
      
      Both MDL subsystems and Table Definition Cache code assume 
      that callers ensure that names of objects passed to them are 
      not longer than NAME_LEN bytes. Unfortunately due to bugs in 
      callers this assumption might be broken in some cases. As
      result we get nasty bugs causing buffer overruns when we
      construct MDL key or TDC key from object names.
      
      This patch makes TDC code more robust against such bugs by 
      ensuring that we always checking size of result buffer when
      constructing TDC keys. This doesn't free its callers from 
      ensuring that both db and table names are shorter than 
      NAME_LEN bytes. But at least this steps prevents buffer 
      overruns in case of bug in caller, replacing them with less 
      harmful behavior.
      
      This is 5.1-only version of patch.
      
      This patch introduces new version of create_table_def_key()
      helper function which constructs TDC key without risk of
      result buffer overrun. Places in code that construct TDC keys 
      were changed to use this function.
      
      Also changed rm_temporary_table() and open_new_frm() functions
      to avoid use of "unsafe" strmov() and strxmov() functions and 
      use safer strnxmov() instead.
      2e10e7c3
    • unknown's avatar
    • Annamalai Gurusami's avatar
      Bug #14200010 NEWLY CREATED TABLE DOESN'T ALLOW FOR LOOSE INDEX SCANS · d426504b
      Annamalai Gurusami authored
      Problem:
      
      Before the ALTER TABLE statement, the array
      dict_index_t::stat_n_diff_key_vals had proper values calculated
      and updated.  But after the ALTER TABLE statement, all the values
      of this array is 0.  
      
      Because of this statistics returned by innodb_rec_per_key() is
      different before and after the ALTER TABLE statement. Running the
      ANALYZE TABLE command populates the statistics correctly.
      
      Solution:
      
      After ALTER TABLE statement, set the flag dict_table_t::stat_initialized
      correctly so that the table statistics will be recalculated properly when
      the table is next loaded.  But note that we still don't choose the loose
      index scans.  This fix only ensures that an ALTER TABLE does not change
      the optimizer plan.
      
      rb://1639 approved by Marko and Jimmy.
      d426504b
  21. 09 Dec, 2012 2 commits
    • Shivji Kumar Jha's avatar
      BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE PL_ROW_UNTIL TIMES OUT · 6b3dad83
      Shivji Kumar Jha authored
             
             patch to fix post push falures in pb2 
      
      BUG#15872504 - REMOVE MYSQL-TEST/INCLUDE/GET_BINLOG_DUMP_THREAD_ID.INC
                  
      === Problem ===
                  
      The file named "mysql-test/include/get_binlog_dump_thread_id.inc" is not 
      used anywhere. In any case, this file does wrong things in the wrong way:
      1) The file seems to assume there is only one dump thread, but there may 
         be many.
      2) you can get this information in a much easier way using the command:
         "select thread_id from threads where processlist_command="Binlog Dump";"
      
      === Fix ===
                
      removed file 'mysql-test/include/get_binlog_dump_thread_id.inc'
      6b3dad83
    • Shivji Kumar Jha's avatar
      BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE · 51d43baa
      Shivji Kumar Jha authored
                     RPL_ROW_UNTIL TIMES OUT
       
       patch to fix post push falures in pb2 
      
      mysql-test/suite/rpl/r/rpl_row_until.result:
        changes to account for the changes made in
        corresponding test file.
      mysql-test/suite/rpl/t/disabled.def:
        disabled test in macosx
      mysql-test/suite/rpl/t/rpl_row_until.test:
        replaced static relayy log file by an mtr variable
        which saves the name of relay log file.
      51d43baa
  22. 07 Dec, 2012 1 commit
    • Joerg Bruehe's avatar
      Last-minute fix to 5.1.67, · d07b5f1c
      Joerg Bruehe authored
      taking a change done to main 5.1 by Dmitri Lenev.
      
      This is the original comment:
      
      > committer: Dmitry Lenev <Dmitry.Lenev@oracle.com>
      > branch nick: mysql-5.1-15954896
      > timestamp: Wed 2012-12-05 19:26:56 +0400
      > message:
      >   Bug #15954896 "SP, MULTI-TABLE DELETE AND LONG ALIAS".
      
        Using too long table aliases in stored routines might
        have caused server crashes.
      
        Code in sp_head::merge_table_list() which is responsible
        for collecting information about tables used in stored
        routine was not aware of the fact that table alias might
        have arbitrary length. I.e. it assumed that table alias
        can't be longer than NAME_LEN bytes and allocated buffer
        for a key identifying table accordingly.
      
        This patch fixes the issue by ensuring that we use
        dynamically allocated buffer for table key when table
        alias is too long. By default stack based buffer is used
        in which NAME_LEN bytes are reserved for table alias.
      d07b5f1c
  23. 05 Dec, 2012 2 commits
    • Dmitry Lenev's avatar
      Bug #15954896 "SP, MULTI-TABLE DELETE AND LONG ALIAS". · 095e8271
      Dmitry Lenev authored
      Using too long table aliases in stored routines might
      have caused server crashes.
      
      Code in sp_head::merge_table_list() which is responsible 
      for collecting information about tables used in stored
      routine was not aware of the fact that table alias might
      have arbitrary length. I.e. it assumed that table alias
      can't be longer than NAME_LEN bytes and allocated buffer
      for a key identifying table accordingly.
      
      This patch fixes the issue by ensuring that we use
      dynamically allocated buffer for table key when table
      alias is too long. By default stack based buffer is used
      in which NAME_LEN bytes are reserved for table alias.
      095e8271
    • Shivji Kumar Jha's avatar
      BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE RPL_ROW_UNTIL TIMES OUT · 055cffb4
      Shivji Kumar Jha authored
            
      === Problem ===
            
      The test is dependent on binlog positions and checks
      to see if the command 'START SLAVE' functions correctly
      with the 'UNTIL' clause added to it. The 'UNTIL' clause
      is added to specify that the slave should start and run
      until the SQL thread reaches a given point in the master
      binary log or in the slave relay log.
            
      The test uses hard coded values for MASTER_LOG_POS and
      RELAY_LOG_POS, instead of extracting it using
      query_get_value() function. There is a test
      'rpl.rpl_row_until' which does the similar thing but uses 
      query_get_value() function to set the values of
      MASTER_LOG_POS/ RELAY_LOG_POS. To be precise,
      rpl.rpl_row_until is a modified version of
      engines/func.rpl_row_until.test.
            
      The use of hard coded values may lead the slave to stop at a position
      which may differ from the expected position in the binlog file,
      an example being the failure of engines/funcs.rpl_row_until in 
      mysql-5.1 given as: 
      "query 'select * from t2' failed. Table 'test.t2' doesn't exist".
      In this case, the slave actually ran a couple of extra commands
      as a result of which the slave first deleted the table and then
      ran a select query on table, leading to the above mentioned failure.
            
      === Fix ===
          
      1) Fixed the code for failure seen in rpl.rpl_row_until.
         This test was also failing although the symptoms of
         failure were different.
      2) Copied the contents from rpl.rpl_row_until into
         into engines/funcs.rpl.rpl_row_until.
      3) Updated engines/funcs.rpl_row_until.result accordingly.
      
      mysql-test/suite/engines/funcs/r/rpl_row_until.result:
        modified to accomodate the changes in corresponding
        test file.
      mysql-test/suite/engines/funcs/t/disabled.def:
        removed from the list of disabled tests.
      mysql-test/suite/engines/funcs/t/rpl_row_until.test:
        fixed rpl.rpl_row_until and copied its content to
        engines/funcs.rpl_row_until. The reason being both
        are same tests but rpl.rpl_row_until is an
        updated version.
      mysql-test/suite/rpl/t/disabled.def:
        removed from the list of disabled tests.
      sql/sql_repl.cc:
        Added a check to catch an improper combination
        of arguements passed to 'START SLAVE UNTIL'. Earlier,
        START SLAVE UNTIL MASTER_LOG_FILE='master-bin.000001',
        MASTER_LOG_POS=561, RELAY_LOG_POS=12;
        passed. It is now detected and an error is reported.
      055cffb4
  24. 01 Dec, 2012 2 commits
    • Mattias Jonsson's avatar
      merge of bug#14589559 into mysql-5.1 · b6249e51
      Mattias Jonsson authored
      b6249e51
    • Libing Song's avatar
      Bug#11764602 ASSERTION IN · bdfc4dc6
      Libing Song authored
      FORMAT_DESCRIPTION_LOG_EVENT::CALC_SERVER_VERSION_SPLIT
      
      Problem: When reading a Format_description_log_event, it supposes MySQL
      version is always valid and DBUG_ASSERTION is used check the version number.
      However, user may give a wrong binlog offset, even give a faked binary event
      which includes an invalid MySQL version. This will cause server crash.
      
      Fix: The assertions are removed and an error will be reported if MySQL
      version in Format_description_log_event is invalid.
      bdfc4dc6