1. 15 Nov, 2010 2 commits
  2. 12 Nov, 2010 1 commit
    • Alexander Barkov's avatar
      Bug#58005 utf8 + get_format causes failed assertion: !str || str != Ptr' · 0e1c167e
      Alexander Barkov authored
      Problem: When GET_FORMAT() is called two times from the upper
      level function (e.g. LEAST in the bug report), on the second
      call "res= args[0]->val_str(...)" and str point to the same
      String object.
      
      1. Fix: changing the order from
      - get val_str into tmp_value then convert to str
      to
      - get val_str into str then convert to tmp_value
      
      The new order is more correct: the purpose of "str" parameter
      is exactly to call val_str() for arguments.
      The purpose of String class members (like tmp_value) is to do further
      actions on the result.
      Doing it in the other way around give unexpected surprises.
      
      2. Using str_value instead of str to do padding, for the same reason.
      0e1c167e
  3. 11 Nov, 2010 1 commit
    • Alexander Barkov's avatar
      Bug#57257 Replace(ExtractValue(...)) causes MySQL crash · 771137b5
      Alexander Barkov authored
      Bug#57820 extractvalue crashes
      
      Problem: ExtractValue and Replace crashed in some cases
      due to invalid handling of empty and NULL arguments.
      
      Per file comments:
      
        @mysql-test/r/ctype_ujis.result
        @mysql-test/r/xml.result
        @mysql-test/t/ctype_ujis.test
        @mysql-test/t/xml.test
        Adding tests
      
        @sql/item_strfunc.cc
        Make sure Item_func_replace::val_str safely handles empty strings.
      
        @sql/item_xmlfunc.cc
        set null_value if nodeset_func returned NULL,
        which is possible when the second argument is an
        unset user variable.
      771137b5
  4. 08 Nov, 2010 3 commits
  5. 03 Nov, 2010 2 commits
  6. 01 Nov, 2010 2 commits
  7. 29 Oct, 2010 7 commits
    • Georgi Kodinov's avatar
      merge · 9cd91393
      Georgi Kodinov authored
      9cd91393
    • Georgi Kodinov's avatar
      merge to 5.1-security · 860c9d9c
      Georgi Kodinov authored
      860c9d9c
    • Georgi Kodinov's avatar
      merge to 5.1-security · 5ddd6c07
      Georgi Kodinov authored
      5ddd6c07
    • Georgi Kodinov's avatar
      merge to 5.0-security · db256441
      Georgi Kodinov authored
      db256441
    • Sergey Glukhov's avatar
      Bug#57688 Assertion `!table || (!table->write_set || bitmap_is_set(table->write_set, field · e3917c3d
      Sergey Glukhov authored
      Lines below which were added in the patch for Bug#56814 cause this crash:
      
      +      if (table->table)
      +        table->table->maybe_null= FALSE;
      
      Consider following test case:
      --
      CREATE TABLE t1(f1 INT NOT NULL);
      INSERT INTO t1 VALUES (16777214),(0);
      
      SELECT COUNT(*) FROM t1 LEFT JOIN t1 t2
      ON 1 WHERE t2.f1 > 1 GROUP BY t2.f1;
      
      DROP TABLE t1;
      --
      
      We set TABLE::maybe_null to FALSE for t2 table
      and in create_tmp_field() we create appropriate tmp table field
      using create_tmp_field_from_item() function instead of
      create_tmp_field_from_field. As a result we have
      LONGLONG field. As we have GROUP BY clause we calculate
      group buffer length, see calc_group_buffer().
      Item from group list which is used for calculation
      refer to the field from real tables and have LONG type.
      So group buffer length become insufficient for storing of
      LONGLONG value. It leads to overwriting of wrong memory
      area in do_field_int() function which is called from
      end_update().
      After some investigation I found out that
      create_tmp_field_from_item() is used only for OLAP
      grouping and can not be used for common grouping
      as it could be an incompatibility between tmp
      table fields and group buffer length.
      We can not remove create_tmp_field_from_item() call from
      create_tmp_field as OLAP needs it and we can not use this
      function for common grouping. So we should remove setting
      TABLE::maybe_null to FALSE from simplify_joins().
      In this case we'll get wrong behaviour of
      list_contains_unique_index() back. To fix it we
      could use Field::real_maybe_null() check instead of
      Field::maybe_null() and add addition check of
      TABLE_LIST::outer_join.
      e3917c3d
    • Vasil Dimov's avatar
      Merge mysql-5.1-innodb -> mysql-5.1-bugteam · 9cff440d
      Vasil Dimov authored
      9cff440d
    • Sergey Glukhov's avatar
      Bug#57194 group_concat cause crash and/or invalid memory reads with type errors · 3a61843a
      Sergey Glukhov authored
      The problem is caused by bug49487 fix and became visible
      after after bug56679 fix.
      Items are cleaned up and set to unfixed state after filling derived table.
      So we can not rely on item::fixed state in Item_func_group_concat::print
      and we can not use 'args' array as items there may be cleaned up.
      The fix is always to use orig_args array of items as it
      always should contain the correct data.
      3a61843a
  8. 28 Oct, 2010 2 commits
    • Calvin Sun's avatar
      Bug#52062: Compiler warning in os0file.c on windows 64-bit · bc921dd7
      Calvin Sun authored
      On Windows, the parameter for number of bytes passed into WriteFile()
      and ReadFile() is DWORD. Casting is needed to silence the warning on
      64-bit Windows.
      
      Also, adding several asserts to ensure the variable for number of bytes
      is no more than 32 bits, even on 64-bit Windows.
      
      This is for InnoDB Plugin.
      
      rb://415
      Approved by: Inaam
      bc921dd7
    • Calvin Sun's avatar
      Bug#52062: Compiler warning in os0file.c on windows 64-bit · 6cc24b9a
      Calvin Sun authored
      On Windows, the parameter for number of bytes passed into WriteFile()
      and ReadFile() is DWORD. Casting is needed to silence the warning on
      64-bit Windows.
      
      Also, adding several asserts to ensure the variable for number of bytes
      is no more than 32 bits, even on 64-bit Windows.
      
      This is for built-in InnoDB.
      
      rb://415
      Approved by: Inaam
      6cc24b9a
  9. 27 Oct, 2010 3 commits
  10. 26 Oct, 2010 1 commit
  11. 25 Oct, 2010 3 commits
  12. 23 Oct, 2010 1 commit
    • 's avatar
      Bug#27606 GRANT statement should be replicated with DEFINER information · 180e74bd
      authored
      "Grantor" columns' data is lost when replicating mysql.tables_priv.
      Slave SQL thread used its default user ''@'' as the grantor of GRANT|REVOKE
      statements executing on it.
      
      In this patch, current user is put in query log event for all GRANT and REVOKE
      statement, SQL thread uses the user in query log event as grantor.
      180e74bd
  13. 21 Oct, 2010 4 commits
    • Bjorn Munch's avatar
      Follow-up to Bug #55582 which allows checking strings in if · bad7fa7c
      Bjorn Munch authored
        Simplified cases where a select was used to compare variable against ''
      bad7fa7c
    • 's avatar
      Bug#55478 Row events wrongly apply on the temporary table of the same name · aa235b1b
      authored
      Rows events were applied wrongly on the temporary table with the same name.
      But rows events are generated only for base tables. As temporary
      table's data never be binlogged on row mode. Normally, base table of the
      same name cannot be updated if a temporary table has the same name.
      But there are two cases which can generate rows events on 
      the base table of same name.
            
      Case1: 'CREATE TABLE ... SELECT' statement.
      In mixed format, it will generate rows events if it is unsafe.
            
      Case2: Drop a transactional temporary table in a transaction
             (happens only on 5.5+).
      BEGIN;
      DROP TEMPORARY TABLE t1;       # t1 is a InnoDB table
      INSERT INTO t1 VALUES(rand()); # t1 is a MyISAM table
      COMMIT;
      'DROP TEMPORARY TABLE' will be put in the transaction cache and
      binlogged after the rows events generated by the 'INSERT' statement.
            
      After this patch, slave opens only base table when applying a rows event.
      aa235b1b
    • Jimmy Yang's avatar
      Fix Bug #57616 Sig 11 in dict_load_table() when failed to load · 59f35ce8
      Jimmy Yang authored
      index or foreign key
      
      Approved by Sunny Bains
      59f35ce8
    • Jimmy Yang's avatar
      Fix bug #57616 Sig 11 in dict_load_table() when failed to load index · 56c30837
      Jimmy Yang authored
      or foreign key
      
      Fix approved by Sunny Bains
      56c30837
  14. 20 Oct, 2010 6 commits
  15. 19 Oct, 2010 2 commits