Merge sama.ndb.mysql.com:/export/space/pekka/ndb/version/my50-bug34107

into  sama.ndb.mysql.com:/export/space/pekka/ndb/version/my51-bug34107

mysql-test/suite/ndb/r/ndb_condition_pushdown.result

@@ -1904,6 +1904,12 @@ a	b	d
 10	1	4369
 20	2	8738
 50	5	21845
+-- big filter just below limit
+a	b	d
+10	1	4369
+20	2	8738
+50	5	21845
+-- big filter just above limit
 a	b	d
 10	1	4369
 20	2	8738

storage/ndb/include/ndbapi/ndbapi_limits.h

@@ -26,6 +26,7 @@
 #define NDB_MAX_TUPLE_SIZE (NDB_MAX_TUPLE_SIZE_IN_WORDS*4)
 #define NDB_MAX_ACTIVE_EVENTS 100
 
-#define NDB_MAX_SCANFILTER_SIZE_IN_WORDS 50000
+/* TUP ZATTR_BUFFER_SIZE 16384 (minus 1) minus place for getValue()s */
+#define NDB_MAX_SCANFILTER_SIZE_IN_WORDS (16384 - 1 - 1024)
 
 #endif

storage/ndb/src/kernel/blocks/dbtup/Dbtup.hpp

@@ -251,6 +251,7 @@ inline const Uint32* ALIGN_WORD(const void* ptr)
 #define ZUNSUPPORTED_BRANCH 892
 
 #define ZSTORED_SEIZE_ATTRINBUFREC_ERROR 873 // Part of Scan
+#define ZSTORED_TOO_MUCH_ATTRINFO_ERROR 874
 
 #define ZREAD_ONLY_CONSTRAINT_VIOLATION 893
 #define ZVAR_SIZED_NOT_SUPPORTED 894
@@ -2539,7 +2540,8 @@ private:
                      Operationrec* regOperPtr,
                      Uint32 lenAttrInfo);
   void storedSeizeAttrinbufrecErrorLab(Signal* signal,
-                                       Operationrec* regOperPtr);
+                                       Operationrec* regOperPtr,
+                                       Uint32 errorCode);
   bool storedProcedureAttrInfo(Signal* signal,
                                Operationrec* regOperPtr,
 			       const Uint32* data,

storage/ndb/src/kernel/blocks/dbtup/DbtupExecQuery.cpp

@@ -75,9 +75,17 @@ void Dbtup::copyAttrinfo(Operationrec * regOperPtr,
     jam();
     ndbrequire(copyAttrBufPtr.i < RnoOfAttrBufrec);
     ptrAss(copyAttrBufPtr, attrbufrec);
-    RbufLen= copyAttrBufPtr.p->attrbuf[ZBUF_DATA_LEN];
-    Rnext= copyAttrBufPtr.p->attrbuf[ZBUF_NEXT];
-    Rfirst= cfirstfreeAttrbufrec;
+    RbufLen = copyAttrBufPtr.p->attrbuf[ZBUF_DATA_LEN];
+    Rnext = copyAttrBufPtr.p->attrbuf[ZBUF_NEXT];
+    Rfirst = cfirstfreeAttrbufrec;
+    /*
+     * ATTRINFO comes from 2 mutually exclusive places:
+     * 1) TUPKEYREQ (also interpreted part)
+     * 2) STORED_PROCREQ before scan start
+     * Assert here that both have a check for overflow.
+     * The "<" instead of "<=" is intentional.
+     */
+    ndbrequire(RinBufIndex + RbufLen < ZATTR_BUFFER_SIZE);
     MEMCOPY_NO_WORDS(&inBuffer[RinBufIndex],
                      &copyAttrBufPtr.p->attrbuf[0],
                      RbufLen);

storage/ndb/src/kernel/blocks/dbtup/DbtupStoredProcDef.cpp

@@ -106,6 +106,11 @@ void Dbtup::scanProcedure(Signal* signal,
   regOperPtr->attrinbufLen = lenAttrInfo;
   regOperPtr->currentAttrinbufLen = 0;
   regOperPtr->storedProcPtr = storedPtr.i;
+  if (lenAttrInfo >= ZATTR_BUFFER_SIZE) { // yes ">="
+    jam();
+    // send REF and change state to ignore the ATTRINFO to come
+    storedSeizeAttrinbufrecErrorLab(signal, regOperPtr, ZSTORED_TOO_MUCH_ATTRINFO_ERROR);
+  }
 }//Dbtup::scanProcedure()
 
 void Dbtup::copyProcedure(Signal* signal,
@@ -146,7 +151,7 @@ bool Dbtup::storedProcedureAttrInfo(Signal* signal,
   Uint32 RnoFree = cnoFreeAttrbufrec;
   if (ERROR_INSERTED(4004) && !copyProcedure) {
     CLEAR_ERROR_INSERT_VALUE;
-    storedSeizeAttrinbufrecErrorLab(signal, regOperPtr);
+    storedSeizeAttrinbufrecErrorLab(signal, regOperPtr, ZSTORED_SEIZE_ATTRINBUFREC_ERROR);
     return false;
   }//if
   regOperPtr->currentAttrinbufLen += length;
@@ -162,7 +167,7 @@ bool Dbtup::storedProcedureAttrInfo(Signal* signal,
     regAttrPtr.p->attrbuf[ZBUF_NEXT] = RNIL;
   } else {
     jam();
-    storedSeizeAttrinbufrecErrorLab(signal, regOperPtr);
+    storedSeizeAttrinbufrecErrorLab(signal, regOperPtr, ZSTORED_SEIZE_ATTRINBUFREC_ERROR);
     return false;
   }//if
   if (regOperPtr->firstAttrinbufrec == RNIL) {
@@ -190,7 +195,7 @@ bool Dbtup::storedProcedureAttrInfo(Signal* signal,
   }//if
   if (ERROR_INSERTED(4005) && !copyProcedure) {
     CLEAR_ERROR_INSERT_VALUE;
-    storedSeizeAttrinbufrecErrorLab(signal, regOperPtr);
+    storedSeizeAttrinbufrecErrorLab(signal, regOperPtr, ZSTORED_SEIZE_ATTRINBUFREC_ERROR);
     return false;
   }//if
 
@@ -212,7 +217,8 @@ bool Dbtup::storedProcedureAttrInfo(Signal* signal,
 }//Dbtup::storedProcedureAttrInfo()
 
 void Dbtup::storedSeizeAttrinbufrecErrorLab(Signal* signal,
-                                            Operationrec* regOperPtr)
+                                            Operationrec* regOperPtr,
+                                            Uint32 errorCode)
 {
   StoredProcPtr storedPtr;
   c_storedProcPool.getPtr(storedPtr, regOperPtr->storedProcPtr);
@@ -224,7 +230,7 @@ void Dbtup::storedSeizeAttrinbufrecErrorLab(Signal* signal,
   regOperPtr->m_any_value = 0;
   set_trans_state(regOperPtr, TRANS_ERROR_WAIT_STORED_PROCREQ);
   signal->theData[0] = regOperPtr->userpointer;
-  signal->theData[1] = ZSTORED_SEIZE_ATTRINBUFREC_ERROR;
+  signal->theData[1] = errorCode;
   signal->theData[2] = regOperPtr->storedProcPtr;
   sendSignal(DBLQH_REF, GSN_STORED_PROCREF, signal, 3, JBB);
 }//Dbtup::storedSeizeAttrinbufrecErrorLab()