Merge zippy.cornsilk.net:/home/cmiller/work/mysql/bug15776/my51-bug15776

into  zippy.cornsilk.net:/home/cmiller/work/mysql/bug15776-encore/my51-bug15776-encore

mysql-test/t/type_blob.test

@@ -446,5 +446,169 @@ INSERT INTO t (c) VALUES (REPEAT('2',65536));
 INSERT INTO t (c) VALUES (REPEAT('3',65535));
 SELECT LENGTH(c), CHAR_LENGTH(c) FROM t;
 DROP TABLE t;
+# Bug#15776: 32-bit signed int used for length of blob
+# """LONGBLOB:  A BLOB column with a maximum length of 4,294,967,295 or 4GB."""
+#
+# Conditions should be in this order:
+# A size is not in the allowed bounds.
+# If the type is char-ish AND size is within the max blob size:
+#   raise ER_TOO_BIG_FIELDLENGTH  (suggest using BLOB)
+# If size is too small:
+#   raise ER_PARSE_ERROR
+# raise ER_TOO_BIG_DISPLAYWIDTH
+
+# BLOB and TEXT types
+--disable_warnings
+drop table if exists b15776;
+--enable_warnings
+create table b15776 (data blob(2147483647));
+drop table b15776;
+--error ER_PARSE_ERROR
+create table b15776 (data blob(-1));
+create table b15776 (data blob(2147483648));
+drop table b15776;
+create table b15776 (data blob(4294967294));
+drop table b15776;
+create table b15776 (data blob(4294967295));
+drop table b15776;
+--error ER_TOO_BIG_DISPLAYWIDTH
+create table b15776 (data blob(4294967296));
+
+CREATE TABLE b15776 (a blob(2147483647), b blob(2147483648), c blob(4294967295), a1 text(2147483647), b1 text(2147483648), c1 text(4294967295) );
+show columns from b15776;
+drop table b15776;
+
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a blob(4294967296));
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a text(4294967296));
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a blob(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a text(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
+
+# Int types
+# "Another extension is supported by MySQL for optionally specifying the
+# display width of integer data types in parentheses following the base keyword
+# for the type (for example, INT(4)). This optional display width is used to
+# display integer values having a width less than the width specified for the
+# column by left-padding them with spaces."   § Numeric Types
+CREATE TABLE b15776 (a int(0)); # 0 is special case, means default size
+INSERT INTO b15776 values (NULL), (1), (42), (654);
+SELECT * from b15776 ORDER BY a;
+DROP TABLE b15776;
+--error ER_PARSE_ERROR
+CREATE TABLE b15776 (a int(-1));
+CREATE TABLE b15776 (a int(255));
+DROP TABLE b15776;
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a int(256));
+--error ER_PARSE_ERROR
+CREATE TABLE b15776 (data blob(-1));
+
+# Char types
+# Recommend BLOB
+--error ER_TOO_BIG_FIELDLENGTH
+CREATE TABLE b15776 (a char(2147483647));
+--error ER_TOO_BIG_FIELDLENGTH
+CREATE TABLE b15776 (a char(2147483648));
+--error ER_TOO_BIG_FIELDLENGTH
+CREATE TABLE b15776 (a char(4294967295));
+# Even BLOB won't hold
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a char(4294967296));
+
+
+# Other numeric-ish types
+## For year, widths not "2" or "4" are silently rewritten to "4".  But
+## When we complain about it, we say that the max is 255.  We may be 
+## talking about different things.  It's confusing.
+CREATE TABLE b15776 (a year(4294967295));
+INSERT INTO b15776 VALUES (42);
+SELECT * FROM b15776;
+DROP TABLE b15776;
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a year(4294967296));
+CREATE TABLE b15776 (a year(0));  # 0 is special case, means default size
+DROP TABLE b15776;
+--error ER_PARSE_ERROR
+CREATE TABLE b15776 (a year(-2));
+
+## For timestamp, we silently rewrite widths to 14 or 19.
+CREATE TABLE b15776 (a timestamp(4294967294));
+DROP TABLE b15776;
+CREATE TABLE b15776 (a timestamp(4294967295));
+DROP TABLE b15776;
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a timestamp(4294967296));
+--error ER_PARSE_ERROR
+CREATE TABLE b15776 (a timestamp(-1));
+--error ER_PARSE_ERROR
+CREATE TABLE b15776 (a timestamp(-2));
+
+
+# We've already tested the case, but this should visually show that 
+# widths that are too large to be interpreted cause DISPLAYWIDTH errors.
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a int(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a char(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a year(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
+--error ER_TOO_BIG_DISPLAYWIDTH
+CREATE TABLE b15776 (a timestamp(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
+
+## Do not select, too much memory needed.
+CREATE TABLE b15776 select cast(null as char(4294967295));
+show columns from b15776;
+drop table b15776;
+CREATE TABLE b15776 select cast(null as nchar(4294967295));
+show columns from b15776;
+drop table b15776;
+CREATE TABLE b15776 select cast(null as binary(4294967295));
+show columns from b15776;
+drop table b15776;
+
+explain select cast(1 as char(4294967295));
+explain select cast(1 as nchar(4294967295));
+explain select cast(1 as binary(4294967295));
+
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select cast(1 as char(4294967296));
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select cast(1 as nchar(4294967296));
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select cast(1 as binary(4294967296));
+
+--error ER_PARSE_ERROR
+explain select cast(1 as decimal(-1));
+explain select cast(1 as decimal(64, 30));
+# It's not as important which errors are raised for these, since the 
+# limit is nowhere near 2**32.  We may fix these eventually to take
+# 4294967295 and still reject it because it's greater than 64 or 30, 
+# but that's not a high priority and the parser needn't worry about 
+# such a weird case.
+--error ER_TOO_BIG_SCALE,ER_PARSE_ERROR
+explain select cast(1 as decimal(64, 999999999999999999999999999999));
+--error ER_TOO_BIG_PRECISION,ER_PARSE_ERROR
+explain select cast(1 as decimal(4294967296));
+--error ER_TOO_BIG_PRECISION,ER_PARSE_ERROR
+explain select cast(1 as decimal(999999999999999999999999999999999999));
+
+explain select convert(1, char(4294967295));
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select convert(1, char(4294967296));
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select convert(1, char(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
+explain select convert(1, nchar(4294967295));
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select convert(1, nchar(4294967296));
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select convert(1, nchar(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
+explain select convert(1, binary(4294967295));
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select convert(1, binary(4294967296));
+--error ER_TOO_BIG_DISPLAYWIDTH
+explain select convert(1, binary(999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999));
 
 --echo End of 5.0 tests

sql/field.cc

@@ -7568,6 +7568,7 @@ uint32 Field_blob::get_length(const uchar *pos, uint packlength_arg, bool low_by
       return (uint32) tmp;
     }
   }
+  /* When expanding this, see also MAX_FIELD_BLOBLENGTH. */
   return 0;					// Impossible
 }
 
@@ -9449,8 +9450,20 @@ bool Create_field::init(THD *thd, char *fld_name, enum_field_types fld_type,
       (fld_type_modifier & NOT_NULL_FLAG) && fld_type != MYSQL_TYPE_TIMESTAMP)
     flags|= NO_DEFAULT_VALUE_FLAG;
 
-  if (fld_length && !(length= (uint) atoi(fld_length)))
-    fld_length= 0; /* purecov: inspected */
+  if (fld_length != NULL)
+  {
+    errno= 0;
+    length= strtoul(fld_length, NULL, 10);
+    if ((errno != 0) || (length > MAX_FIELD_BLOBLENGTH))
+    {
+      my_error(ER_TOO_BIG_DISPLAYWIDTH, MYF(0), fld_name, MAX_FIELD_BLOBLENGTH);
+      DBUG_RETURN(TRUE);
+    }
+
+    if (length == 0)
+      fld_length= 0; /* purecov: inspected */
+  }
+
   sign_len= fld_type_modifier & UNSIGNED_FLAG ? 0 : 1;
 
   switch (fld_type) {
@@ -9598,7 +9611,7 @@ bool Create_field::init(THD *thd, char *fld_name, enum_field_types fld_type,
     }
     break;
   case MYSQL_TYPE_TIMESTAMP:
-    if (!fld_length)
+    if (fld_length == NULL)
     {
       /* Compressed date YYYYMMDDHHMMSS */
       length= MAX_DATETIME_COMPRESSED_WIDTH;
@@ -9607,12 +9620,21 @@ bool Create_field::init(THD *thd, char *fld_name, enum_field_types fld_type,
     {
       /*
         We support only even TIMESTAMP lengths less or equal than 14
-        and 19 as length of 4.1 compatible representation.
+        and 19 as length of 4.1 compatible representation.  Silently 
+        shrink it to MAX_DATETIME_COMPRESSED_WIDTH.
       */
-      length= ((length+1)/2)*2; /* purecov: inspected */
-      length= min(length, MAX_DATETIME_COMPRESSED_WIDTH); /* purecov: inspected */
+	  DBUG_ASSERT(MAX_DATETIME_COMPRESSED_WIDTH < UINT_MAX);
+      if (length != UINT_MAX)  /* avoid overflow; is safe because of min() */
+        length= ((length+1)/2)*2;
+      length= min(length, MAX_DATETIME_COMPRESSED_WIDTH);
     }
     flags|= ZEROFILL_FLAG | UNSIGNED_FLAG;
+    /*
+      Since we silently rewrite down to MAX_DATETIME_COMPRESSED_WIDTH bytes,
+      the parser should not raise errors unless bizzarely large. 
+     */
+    max_field_charlength= UINT_MAX;
+
     if (fld_default_value)
     {
       /* Grammar allows only NOW() value for ON UPDATE clause */
@@ -9719,7 +9741,7 @@ bool Create_field::init(THD *thd, char *fld_name, enum_field_types fld_type,
       ((length > max_field_charlength && fld_type != MYSQL_TYPE_SET &&
         fld_type != MYSQL_TYPE_ENUM &&
         (fld_type != MYSQL_TYPE_VARCHAR || fld_default_value)) ||
-       (!length &&
+       ((length == 0) &&
         fld_type != MYSQL_TYPE_STRING &&
         fld_type != MYSQL_TYPE_VARCHAR && fld_type != MYSQL_TYPE_GEOMETRY)))
   {

sql/item_create.cc

@@ -5057,8 +5057,23 @@ create_func_cast(THD *thd, Item *a, Cast_target cast_type,
     break;
   case ITEM_CAST_DECIMAL:
   {
-    len= c_len ? atoi(c_len) : 0;
-    dec= c_dec ? atoi(c_dec) : 0;
+    if (c_dec == NULL)
+    {
+      dec= 0;
+    }
+    else
+    {
+      ulong decoded_size;
+      errno= 0;
+      decoded_size= strtoul(c_dec, NULL, 10);
+      if ((errno != 0) || (decoded_size > UINT_MAX))
+      {
+        my_error(ER_TOO_BIG_SCALE, MYF(0), c_dec, a->name,
+                 DECIMAL_MAX_SCALE);
+        return NULL;
+      }
+      dec= decoded_size;
+    }
     my_decimal_trim(&len, &dec);
     if (len < dec)
     {
@@ -5083,7 +5098,22 @@ create_func_cast(THD *thd, Item *a, Cast_target cast_type,
   case ITEM_CAST_CHAR:
   {
     CHARSET_INFO *real_cs= (cs ? cs : thd->variables.collation_connection);
-    len= c_len ? atoi(c_len) : -1;
+    if (c_len == NULL)
+    {
+      len= LL(-1);
+    }
+    else
+    {
+      ulong decoded_size;
+      errno= 0;
+      decoded_size= strtoul(c_len, NULL, 10);
+      if (errno != 0)
+      {
+        my_error(ER_TOO_BIG_DISPLAYWIDTH, MYF(0), "cast as char", MAX_FIELD_BLOBLENGTH);
+        return NULL;
+      }
+      len= decoded_size;
+    }
     res= new (thd->mem_root) Item_char_typecast(a, len, real_cs);
     break;
   }

sql/sql_yacc.yy

@@ -1277,7 +1277,7 @@ bool my_yyoverflow(short **a, YYSTYPE **b, ulong *yystacksize);
         single_multi table_wild_list table_wild_one opt_wild
         union_clause union_list
         precision subselect_start opt_and charset
-        subselect_end select_var_list select_var_list_init help opt_len
+        subselect_end select_var_list select_var_list_init help opt_field_length field_length
         opt_extended_describe
         prepare prepare_src execute deallocate
         statement sp_suid
@@ -4628,7 +4628,7 @@ field_spec:
         ;
 
 type:
-          int_type opt_len field_options { $$=$1; }
+          int_type opt_field_length field_options { $$=$1; }
         | real_type opt_precision field_options { $$=$1; }
         | FLOAT_SYM float_options field_options { $$=MYSQL_TYPE_FLOAT; }
         | BIT_SYM
@@ -4636,46 +4636,42 @@ type:
             Lex->length= (char*) "1";
             $$=MYSQL_TYPE_BIT;
           }
-        | BIT_SYM '(' NUM ')'
+        | BIT_SYM field_length
           {
-            Lex->length= $3.str;
             $$=MYSQL_TYPE_BIT;
           }
         | BOOL_SYM
           {
-            Lex->length=(char*) "1";
+            Lex->length= (char*) "1";
             $$=MYSQL_TYPE_TINY;
           }
         | BOOLEAN_SYM
           {
-            Lex->length=(char*) "1";
+            Lex->length= (char*) "1";
             $$=MYSQL_TYPE_TINY;
           }
-        | char '(' NUM ')' opt_binary
+        | char field_length opt_binary
           {
-            Lex->length=$3.str;
             $$=MYSQL_TYPE_STRING;
           }
         | char opt_binary
           {
-            Lex->length=(char*) "1";
+            Lex->length= (char*) "1";
             $$=MYSQL_TYPE_STRING;
           }
-        | nchar '(' NUM ')' opt_bin_mod
+        | nchar field_length opt_bin_mod
           {
-            Lex->length=$3.str;
             $$=MYSQL_TYPE_STRING;
             Lex->charset=national_charset_info;
           }
         | nchar opt_bin_mod
           {
-            Lex->length=(char*) "1";
+            Lex->length= (char*) "1";
             $$=MYSQL_TYPE_STRING;
             Lex->charset=national_charset_info;
           }
-        | BINARY '(' NUM ')'
+        | BINARY field_length
           {
-            Lex->length=$3.str;
             Lex->charset=&my_charset_bin;
             $$=MYSQL_TYPE_STRING;
           }
@@ -4685,30 +4681,27 @@ type:
             Lex->charset=&my_charset_bin;
             $$=MYSQL_TYPE_STRING;
           }
-        | varchar '(' NUM ')' opt_binary
+        | varchar field_length opt_binary
           {
-            Lex->length=$3.str;
             $$= MYSQL_TYPE_VARCHAR;
           }
-        | nvarchar '(' NUM ')' opt_bin_mod
+        | nvarchar field_length opt_bin_mod
           {
-            Lex->length=$3.str;
             $$= MYSQL_TYPE_VARCHAR;
             Lex->charset=national_charset_info;
           }
-        | VARBINARY '(' NUM ')'
+        | VARBINARY field_length
           {
-            Lex->length=$3.str;
             Lex->charset=&my_charset_bin;
             $$= MYSQL_TYPE_VARCHAR;
           }
-        | YEAR_SYM opt_len field_options
+        | YEAR_SYM opt_field_length field_options
           { $$=MYSQL_TYPE_YEAR; }
         | DATE_SYM
           { $$=MYSQL_TYPE_DATE; }
         | TIME_SYM
           { $$=MYSQL_TYPE_TIME; }
-        | TIMESTAMP opt_len
+        | TIMESTAMP opt_field_length
           {
             if (YYTHD->variables.sql_mode & MODE_MAXDB)
               $$=MYSQL_TYPE_DATETIME;
@@ -4728,7 +4721,7 @@ type:
             Lex->charset=&my_charset_bin;
             $$=MYSQL_TYPE_TINY_BLOB;
           }
-        | BLOB_SYM opt_len
+        | BLOB_SYM opt_field_length
           {
             Lex->charset=&my_charset_bin;
             $$=MYSQL_TYPE_BLOB;
@@ -4764,7 +4757,7 @@ type:
           { $$=MYSQL_TYPE_MEDIUM_BLOB; }
         | TINYTEXT opt_binary
           { $$=MYSQL_TYPE_TINY_BLOB; }
-        | TEXT_SYM opt_len opt_binary
+        | TEXT_SYM opt_field_length opt_binary
           { $$=MYSQL_TYPE_BLOB; }
         | MEDIUMTEXT opt_binary
           { $$=MYSQL_TYPE_MEDIUM_BLOB; }
@@ -4854,8 +4847,8 @@ real_type:
 float_options:
           /* empty */
           { Lex->dec=Lex->length= (char*)0; }
-        | '(' NUM ')'
-          { Lex->length=$2.str; Lex->dec= (char*)0; }
+        | field_length
+          { Lex->dec= (char*)0; }
         | precision
           {}
         ;
@@ -4885,11 +4878,17 @@ field_option:
         | ZEROFILL { Lex->type|= UNSIGNED_FLAG | ZEROFILL_FLAG; }
         ;
 
-opt_len:
-          /* empty */ { Lex->length=(char*) 0; /* use default length */ }
-        | '(' NUM ')' { Lex->length= $2.str; }
+opt_field_length:
+          /* empty */  { Lex->length=(char*) 0; /* use default length */ }
+        | field_length {}
         ;
 
+field_length:
+        '(' LONG_NUM ')'      { Lex->length= $2.str; }
+        | '(' ULONGLONG_NUM ')' { Lex->length= $2.str; }
+        | '(' DECIMAL_NUM ')'   { Lex->length= $2.str; }
+        | '(' NUM ')'           { Lex->length= $2.str; };
+
 opt_precision:
           /* empty */ {}
         | precision {}
@@ -7450,11 +7449,11 @@ in_sum_expr:
         ;
 
 cast_type:
-          BINARY opt_len
+          BINARY opt_field_length
           { $$=ITEM_CAST_CHAR; Lex->charset= &my_charset_bin; Lex->dec= 0; }
-        | CHAR_SYM opt_len opt_binary
+        | CHAR_SYM opt_field_length opt_binary
           { $$=ITEM_CAST_CHAR; Lex->dec= 0; }
-        | NCHAR_SYM opt_len
+        | NCHAR_SYM opt_field_length
           { $$=ITEM_CAST_CHAR; Lex->charset= national_charset_info; Lex->dec=0; }
         | SIGNED_SYM
           { $$=ITEM_CAST_SIGNED_INT; Lex->charset= NULL; Lex->dec=Lex->length= (char*)0; }

sql/unireg.h

@@ -63,6 +63,7 @@
 #define MAX_MBWIDTH		3		/* Max multibyte sequence */
 #define MAX_FIELD_CHARLENGTH	255
 #define MAX_FIELD_VARCHARLENGTH	65535
+#define MAX_FIELD_BLOBLENGTH UINT_MAX32     /* cf field_blob::get_length() */
 #define CONVERT_IF_BIGGER_TO_BLOB 512		/* Used for CREATE ... SELECT */
 
 /* Max column width +1 */