1. 21 Mar, 2011 3 commits
  2. 18 Mar, 2011 1 commit
  3. 17 Mar, 2011 3 commits
  4. 16 Mar, 2011 4 commits
  5. 15 Mar, 2011 2 commits
    • Dmitry Shulga's avatar
      Fixed Bug#11764168 "56976: SEVERE DENIAL OF SERVICE IN PREPARED STATEMENTS". · 9320dca9
      Dmitry Shulga authored
      The problem was that server didn't check resulting size of prepared
      statement argument which was set using mysql_send_long_data() API.
      By calling mysql_send_long_data() several times it was possible
      to create overly big string and thus force server to allocate
      memory for it. There was no way to limit this allocation.
      
      The solution is to add check for size of result string against
      value of max_long_data_size start-up parameter. When intermediate
      string exceeds max_long_data_size value an appropriate error message
      is emitted.
      
      We can't use existing max_allowed_packet parameter for this purpose
      since its value is limited by 1GB and therefore using it as a limit
      for data set through mysql_send_long_data() API would have been an
      incompatible change. Newly introduced max_long_data_size parameter
      gets value from max_allowed_packet parameter unless its value is
      specified explicitly. This new parameter is marked as deprecated
      and will be eventually replaced by max_allowed_packet parameter.
      Value of max_long_data_size parameter can be set only at server
      startup.
      
      
      mysql-test/t/variables.test:
        Added checking for new start-up parameter max_long_data_size.
      sql/item.cc:
        Added call to my_message() when accumulated string exceeds
        max_long_data_size value. my_message() calls error handler
        that was installed in mysql_stmt_get_longdata before call
        to Item_param::set_longdata.
        
        The error handler then sets state, last_error and last_errno
        fields for current statement to values which correspond to
        error which was caught.
      sql/mysql_priv.h:
        Added max_long_data_size variable declaration.
      sql/mysqld.cc:
        Added support for start-up parameter 'max_long_data_size'.
        This parameter limits size of data which can be sent from
        client to server using mysql_send_long_data() API.
      sql/set_var.cc:
        Added variable 'max_long_data_size' into list of variables
        displayed by command 'show variables'.
      sql/sql_prepare.cc:
        Added error handler class Set_longdata_error_handler.
        This handler is used to catch any errors that can be
        generated during execution of Item_param::set_longdata().
        
        Source code snippet that makes checking for statement's state 
        during statement execution is moved from Prepared_statement::execute()
        to Prepared_statement::execute_loop() in order not to call
        set_parameters() when statement has failed during
        set_long_data() execution. If this hadn't been done
        the call to set_parameters() would have failed.
      tests/mysql_client_test.c:
        A testcase for the bug #56976 was added.
      9320dca9
    • Georgi Kodinov's avatar
      Bug #11765023: 57934: DOS POSSIBLE SINCE BINARY CASTING DOESN'T · 7a37a7c0
      Georgi Kodinov authored
      ADHERE TO MAX_ALLOWED_PACKET
      
      Added a check for max_packet_length in CONVERT(, BINARY|CHAR).
      Added a test case.
      7a37a7c0
  6. 14 Mar, 2011 1 commit
  7. 11 Mar, 2011 5 commits
  8. 09 Mar, 2011 7 commits
  9. 08 Mar, 2011 1 commit
  10. 03 Mar, 2011 5 commits
    • unknown's avatar
      Merge from mysql-5.1.56-release · d2ac3542
      unknown authored
      d2ac3542
    • Alexander Barkov's avatar
      Bug 11766519 - 59648: MY_STRTOLL10_MB2: ASSERTION `(*ENDPTR - S) % 2 == 0' FAILED. · a1e9be8e
      Alexander Barkov authored
      Part 2. Function QUOTE() was not multi-byte safe.
      
        @ mysql-test/r/ctype_ucs.result
        @ mysql-test/t/ctype_ucs.test
        Adding tests
      
        @ sql/item_strfunc.cc
        Fixing Item_func_quote::val_str to be multi-byte safe.
      
        @ sql/item_strfunc.h
        Multiple size needed for quote characters to mbmaxlen
      a1e9be8e
    • Alexander Barkov's avatar
      BUG#11766519 (bug#59648): MY_STRTOLL10_MB2: ASSERTION `(*ENDPTR - S) % 2 == 0' FAILED · 1bc5e76e
      Alexander Barkov authored
            
      Problem: wrong character set pointer was passed to my_strtoll10_mb2,
      which led to DBUG_ASSERT failure in some cases.
      
        @ mysql-test/r/func_encrypt_ucs2.result
        @ mysql-test/t/func_encrypt_ucs2.test
        @ mysql-test/r/ctype_ucs.result
        @ mysql-test/t/ctype_ucs.test
        Adding tests
      
        @ sql/item_func.cc
        "cs" initialization was wrong (res does not necessarily point to &str_value)
      
        @ sql/item_strfunc.cc
        Item_func_dec_encrypt::val_str() and Item_func_des_descrypt::val_str()
        did not set character set for tmp_value (the returned value),
        so the old value, which was previously copied from args[1]->val_str(),
        was incorrectly returned with tmp_value.
      1bc5e76e
    • Sergey Vojtovich's avatar
      BUG#11764339 - valgrind errors, random data when returning · 54755c78
      Sergey Vojtovich authored
                     ordered data from archive tables
      
      Archive was using wrong memory address to check if field
      is NULL (after filesort, when reading record again).
      
      mysql-test/r/archive.result:
        A test case for BUG#11764339.
      mysql-test/t/archive.test:
        A test case for BUG#11764339.
      storage/archive/ha_archive.cc:
        Null bytes are restored to "record" buffer, which may
        or may not be equal to record buffer for field. Check
        null bits in "record" buffer, instead of Field::null_ptr.
      54755c78
    • Alexander Barkov's avatar
      An after-fix for · 165660fd
      Alexander Barkov authored
      Bug#11765108 - Bug#58036: CLIENT UTF32, UTF16, UCS2 SHOULD BE DISALLOWED, THEY CRASH SERVER 
      
      Fixing wrong usage of DBUG_ASSERT.
      In non-debug version thd_init_client_charset
      was not executed at all.
      165660fd
  11. 01 Mar, 2011 2 commits
  12. 28 Feb, 2011 1 commit
  13. 24 Feb, 2011 2 commits
    • Bjorn Munch's avatar
      merge from 5.1 main · e58e15ff
      Bjorn Munch authored
      e58e15ff
    • Magne Mahre's avatar
      Bug#11767480 - SPATIAL INDEXES ON NON-SPATIAL COLUMNS CAUSE CRASHES. · 27166fc6
      Magne Mahre authored
            
      This is a backport of the patch for MySQL Bug#50574.
            
      Adding a SPATIAL INDEX on non-geometrical columns caused a
      segmentation fault when the table was subsequently 
      inserted into.
                  
      A test was added in mysql_prepare_create_table to explicitly
      check whether non-geometrical columns are used in a
      spatial index, and throw an error if so.
            
      For MySQL 5.5 and later, a new and more meaningful error 
      message was introduced.  For 5.1, we (re-)use an existing
      error code.
      27166fc6
  14. 23 Feb, 2011 1 commit
  15. 22 Feb, 2011 2 commits