Merge 10.0 into 10.1

mysql-test/r/subselect_sj.result

@@ -3186,5 +3186,12 @@ EXECUTE stmt;
 a
 drop view v3;
 drop table t1,t2,t3;
+#
+# MDEV-18896: IN subquery in WHERE of a table-less query used for INSERT
+#
+create table t1 (a1 varchar(25));
+create table t2 (a2 varchar(25)) ;
+insert into t1 select 'xxx' from dual where 'xxx' in (select a2 from t2);
+drop table t1,t2;
 # End of 5.5 test
 set optimizer_switch=@subselect_sj_tmp;

mysql-test/r/subselect_sj_jcl6.result

@@ -3200,6 +3200,13 @@ EXECUTE stmt;
 a
 drop view v3;
 drop table t1,t2,t3;
+#
+# MDEV-18896: IN subquery in WHERE of a table-less query used for INSERT
+#
+create table t1 (a1 varchar(25));
+create table t2 (a2 varchar(25)) ;
+insert into t1 select 'xxx' from dual where 'xxx' in (select a2 from t2);
+drop table t1,t2;
 # End of 5.5 test
 set optimizer_switch=@subselect_sj_tmp;
 #

mysql-test/t/subselect_sj.test

@@ -2873,6 +2873,16 @@ EXECUTE stmt;
 drop view v3;
 drop table t1,t2,t3;
 
+--echo #
+--echo # MDEV-18896: IN subquery in WHERE of a table-less query used for INSERT
+--echo #
+
+create table t1 (a1 varchar(25));
+create table t2 (a2 varchar(25)) ;
+insert into t1 select 'xxx' from dual where 'xxx' in (select a2 from t2);
+
+drop table t1,t2;
+
 --echo # End of 5.5 test
 
 # The following command must be the last one the file 

plugin/auth_pam/auth_pam.c

 /*
-   Copyright (c) 2011, 2012, Monty Program Ab
+   Copyright (c) 2011, 2019, MariaDB Corporation.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -161,7 +161,7 @@ static int pam_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
 
   if (new_username && strcmp(new_username, info->user_name))
     strncpy(info->authenticated_as, new_username,
-            sizeof(info->authenticated_as));
+            sizeof(info->authenticated_as)-1);
   info->authenticated_as[sizeof(info->authenticated_as)-1]= 0;
 
 end:

plugin/server_audit/server_audit.c

@@ -1056,7 +1056,7 @@ static int start_logging()
     }
     error_header();
     fprintf(stderr, "logging started to the file %s.\n", alt_fname);
-    strncpy(current_log_buf, alt_fname, sizeof(current_log_buf));
+    strncpy(current_log_buf, alt_fname, sizeof(current_log_buf)-1);
     current_log_buf[sizeof(current_log_buf)-1]= 0;
   }
   else if (output_type == OUTPUT_SYSLOG)
@@ -1064,7 +1064,8 @@ static int start_logging()
     openlog(syslog_ident, LOG_NOWAIT, syslog_facility_codes[syslog_facility]);
     error_header();
     fprintf(stderr, "logging started to the syslog.\n");
-    strncpy(current_log_buf, "[SYSLOG]", sizeof(current_log_buf));
+    strncpy(current_log_buf, "[SYSLOG]", sizeof(current_log_buf)-1);
+    compile_time_assert(sizeof current_log_buf > sizeof "[SYSLOG]");
   }
   is_active= 1;
   return 0;
@@ -2600,7 +2601,7 @@ static void update_file_path(MYSQL_THD thd,
     internal_stop_logging= 0;
   }
 
-  strncpy(path_buffer, new_name, sizeof(path_buffer));
+  strncpy(path_buffer, new_name, sizeof(path_buffer)-1);
   path_buffer[sizeof(path_buffer)-1]= 0;
   file_path= path_buffer;
 exit_func:
@@ -2653,7 +2654,7 @@ static void update_incl_users(MYSQL_THD thd,
   if (!maria_55_started || !debug_server_started)
     flogger_mutex_lock(&lock_operations);
   mark_always_logged(thd);
-  strncpy(incl_user_buffer, new_users, sizeof(incl_user_buffer));
+  strncpy(incl_user_buffer, new_users, sizeof(incl_user_buffer)-1);
   incl_user_buffer[sizeof(incl_user_buffer)-1]= 0;
   incl_users= incl_user_buffer;
   user_coll_fill(&incl_user_coll, incl_users, &excl_user_coll, 1);
@@ -2672,7 +2673,7 @@ static void update_excl_users(MYSQL_THD thd  __attribute__((unused)),
   if (!maria_55_started || !debug_server_started)
     flogger_mutex_lock(&lock_operations);
   mark_always_logged(thd);
-  strncpy(excl_user_buffer, new_users, sizeof(excl_user_buffer));
+  strncpy(excl_user_buffer, new_users, sizeof(excl_user_buffer)-1);
   excl_user_buffer[sizeof(excl_user_buffer)-1]= 0;
   excl_users= excl_user_buffer;
   user_coll_fill(&excl_user_coll, excl_users, &incl_user_coll, 0);
@@ -2804,7 +2805,7 @@ static void update_syslog_ident(MYSQL_THD thd  __attribute__((unused)),
               void *var_ptr  __attribute__((unused)), const void *save)
 {
   char *new_ident= (*(char **) save) ? *(char **) save : empty_str;
-  strncpy(syslog_ident_buffer, new_ident, sizeof(syslog_ident_buffer));
+  strncpy(syslog_ident_buffer, new_ident, sizeof(syslog_ident_buffer)-1);
   syslog_ident_buffer[sizeof(syslog_ident_buffer)-1]= 0;
   syslog_ident= syslog_ident_buffer;
   error_header();

sql/opt_subselect.cc

@@ -675,7 +675,7 @@ int check_and_do_in_subquery_rewrites(JOIN *join)
         select_lex->outer_select()->join &&                           // 6
         parent_unit->first_select()->leaf_tables.elements &&          // 7
         !in_subs->has_strategy() &&                                   // 8
-        select_lex->outer_select()->leaf_tables.elements &&           // 9
+        select_lex->outer_select()->table_list.first &&               // 9
         !((join->select_options |                                     // 10
            select_lex->outer_select()->join->select_options)          // 10
           & SELECT_STRAIGHT_JOIN) &&                                  // 10

storage/innobase/dict/dict0mem.cc

@@ -2,7 +2,7 @@
 
 Copyright (c) 1996, 2016, Oracle and/or its affiliates. All Rights Reserved.
 Copyright (c) 2012, Facebook Inc.
-Copyright (c) 2013, 2018, MariaDB Corporation.
+Copyright (c) 2013, 2019, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -320,7 +320,8 @@ dict_mem_table_col_rename_low(
 	ut_ad(to_len <= NAME_LEN);
 
 	char from[NAME_LEN + 1];
-	strncpy(from, s, NAME_LEN + 1);
+	strncpy(from, s, sizeof from - 1);
+	from[sizeof from - 1] = '\0';
 
 	if (from_len == to_len) {
 		/* The easy case: simply replace the column name in

storage/xtradb/dict/dict0mem.cc

@@ -2,7 +2,7 @@
 
 Copyright (c) 1996, 2017, Oracle and/or its affiliates. All Rights Reserved.
 Copyright (c) 2012, Facebook Inc.
-Copyright (c) 2013, 2018, MariaDB Corporation.
+Copyright (c) 2013, 2019, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -321,7 +321,8 @@ dict_mem_table_col_rename_low(
 	ut_ad(to_len <= NAME_LEN);
 
 	char from[NAME_LEN + 1];
-	strncpy(from, s, NAME_LEN + 1);
+	strncpy(from, s, sizeof from - 1);
+	from[sizeof from - 1] = '\0';
 
 	if (from_len == to_len) {
 		/* The easy case: simply replace the column name in