1. 24 Aug, 2010 1 commit
    • Alexey Kopytov's avatar
      Bug #55568: user variable assignments crash server when used · 0e74ac50
      Alexey Kopytov authored
                  within query
      
      The server could crash after materializing a derived table
      which requires a temporary table for grouping.
      
      When destroying the temporary table used to execute a query for
      a derived table, JOIN::destroy() did not clean up Item_fields
      pointing to fields in the temporary table. This led to
      dereferencing a dangling pointer when printing out the items
      tree later in the outer SELECT.
      
      The solution is an addendum to the patch for bug37362: in
      addition to cleaning up items in tmp_all_fields3, do the same
      for items in tmp_all_fields1, since now we have an example
      where this is necessary.
      0e74ac50
  2. 16 Aug, 2010 1 commit
  3. 13 Aug, 2010 1 commit
    • Georgi Kodinov's avatar
      Bug #55615 and bug #55564 · a5575096
      Georgi Kodinov authored
      An user assignment variable expression that's 
      evaluated in a logical expression context 
      (Item::val_bool()) can be pre-calculated in a 
      temporary table for GROUP BY.
      However when the expression value is used after the
      temp table creation it was re-evaluated instead of
      being read from the temp table due to a missing 
      val_bool_result() method.
      Fixed by implementing the method.
      a5575096
  4. 06 Aug, 2010 1 commit
    • Gleb Shchepa's avatar
      Bug #55424: convert_tz crashes when fed invalid data · ed736379
      Gleb Shchepa authored
      The CONVERT_TZ function crashes the server when the
      timezone argument is an empty SET field value.
      
      1) The CONVERT_TZ may find a timezone string in the
         tz_names hash.
      2) A string representation of the empty SET is a
         String of zero length with the NULL pointer.
      3) If the key argument length is zero, hash functions
         do comparison using the length of the record being
         compared against.
      
      I.e. a zero-length String buffer is an invalid
      argument for hash search functions, and if String
      points to NULL buffer, hashcmp() fails with SEGV
      accessing that memory.
      
      The my_tz_find function has been modified to
      treat empty Strings as invalid timezone values
      to skip unnecessary hash search.
      ed736379
  5. 05 Aug, 2010 2 commits
    • Sunny Bains's avatar
      Fix Bug #55277 - Failing assertion: auto_inc > 0 · 6c0f9301
      Sunny Bains authored
      Handle overflow when reading value from SELECT MAX(C) FROM T;
      
      Call ha_innobase::info() after initializing the autoinc value
      in ha_innobase::open().
      
      Fix for both the builtin and plugin.
      
      rb://402
      6c0f9301
    • Sunny Bains's avatar
      Fix bug# 55543 - InnoDB Plugin: Signal 6: Assertion failure in file fil/fil0fil.c line 4306 · e19a4942
      Sunny Bains authored
      The bug is due to a double delete of a BLOB, once via:
      
          rollback -> btr_cur_pessimistic_delete()
      
      and the second time via purge.
      
      The bug is in row_upd_clust_rec_by_insert(). There we relinquish ownership
      of the non-updated BLOB columns in btr_cur_mark_extern_inherited_fields()
      before building the row entry that will be inserted and whose contents will
      be logged in the UNDO log. However, we don't set the BLOB column later to
      INHERITED so that a possible rollback will not free the original row's
      non-updated BLOB entries. This is because the condition that checks for
      that is in :
      
      	if (node->upd_ext) {}.
      
      node->upd_ext is non-NULL only if a BLOB column was updated and that column
      is part of some key ordering (see row_upd_replace()). This results in the
      non-update BLOB columns being deleted during a rollback and subsequently by
      purge again.
      
      rb://413
      e19a4942
  6. 04 Aug, 2010 2 commits
  7. 03 Aug, 2010 2 commits
  8. 02 Aug, 2010 4 commits
  9. 01 Aug, 2010 1 commit
    • Gleb Shchepa's avatar
      Bug #54461: crash with longblob and union or update with subquery · 38165ce4
      Gleb Shchepa authored
      Queries may crash, if
        1) the GREATEST or the LEAST function has a mixed list of
           numeric and LONGBLOB arguments and
        2) the result of such a function goes through an intermediate
           temporary table.
      
      An Item that references a LONGBLOB field has max_length of
      UINT_MAX32 == (2^32 - 1).
      
      The current implementation of GREATEST/LEAST returns REAL
      result for a mixed list of numeric and string arguments (that
      contradicts with the current documentation, this contradiction
      was discussed and it was decided to update the documentation).
      
      The max_length of such a function call was calculated as a
      maximum of argument max_length values (i.e. UINT_MAX32).
      
      That max_length value of UINT_MAX32 was used as a length for
      the intermediate temporary table Field_double to hold
      GREATEST/LEAST function result.
      
      The Field_double::val_str() method call on that field
      allocates a String value.
      
      Since an allocation of String reserves an additional byte
      for a zero-termination, the size of String buffer was
      set to (UINT_MAX32 + 1), that caused an integer overflow:
      actually, an empty buffer of size 0 was allocated.
      
      An initialization of the "first" byte of that zero-size
      buffer with '\0' caused a crash.
      
      The Item_func_min_max::fix_length_and_dec() has been
      modified to calculate max_length for the REAL result like
      we do it for arithmetical operators.
      
      
      ******
      Bug #54461: crash with longblob and union or update with subquery
      
      Queries may crash, if
        1) the GREATEST or the LEAST function has a mixed list of
           numeric and LONGBLOB arguments and
        2) the result of such a function goes through an intermediate
           temporary table.
      
      An Item that references a LONGBLOB field has max_length of
      UINT_MAX32 == (2^32 - 1).
      
      The current implementation of GREATEST/LEAST returns REAL
      result for a mixed list of numeric and string arguments (that
      contradicts with the current documentation, this contradiction
      was discussed and it was decided to update the documentation).
      
      The max_length of such a function call was calculated as a
      maximum of argument max_length values (i.e. UINT_MAX32).
      
      That max_length value of UINT_MAX32 was used as a length for
      the intermediate temporary table Field_double to hold
      GREATEST/LEAST function result.
      
      The Field_double::val_str() method call on that field
      allocates a String value.
      
      Since an allocation of String reserves an additional byte
      for a zero-termination, the size of String buffer was
      set to (UINT_MAX32 + 1), that caused an integer overflow:
      actually, an empty buffer of size 0 was allocated.
      
      An initialization of the "first" byte of that zero-size
      buffer with '\0' caused a crash.
      
      The Item_func_min_max::fix_length_and_dec() has been
      modified to calculate max_length for the REAL result like
      we do it for arithmetical operators.
      38165ce4
  10. 30 Jul, 2010 9 commits
  11. 29 Jul, 2010 4 commits
    • Vasil Dimov's avatar
      Merge mysql-5.1-innodb -> mysql-5.1-bugteam · 2aee4d8d
      Vasil Dimov authored
      2aee4d8d
    • Vasil Dimov's avatar
      Merge mysql-5.1-bugteam -> mysql-5.1-innodb · a95441c0
      Vasil Dimov authored
      a95441c0
    • Alexander Barkov's avatar
      Postfix for BUG#45012. · c7071a72
      Alexander Barkov authored
      Problem: The original patch didn't compile on debug_werror
      due to wrong format in printf("%d") for size_t variables.
      
      Fix: Adding cast to (int).
      c7071a72
    • 's avatar
      BUG#49124 Security issue with /*!-versioned */ SQL statements on Slave · 2ad690fd
      authored
      /*![:version:] Query Code */, where [:version:] is a sequence of 5 
      digits representing the mysql server version(e.g /*!50200 ... */),
      is a special comment that the query in it can be executed on those 
      servers whose versions are larger than the version appearing in the 
      comment. It leads to a security issue when slave's version is larger 
      than master's. A malicious user can improve his privileges on slaves. 
      Because slave SQL thread is running with SUPER privileges, so it can
      execute queries that he/she does not have privileges on master.
      
      This bug is fixed with the logic below: 
      - To replace '!' with ' ' in the magic comments which are not applied on
        master. So they become common comments and will not be applied on slave.
      
      - Example:
        'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
        will be binlogged as
        'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/
      2ad690fd
  12. 28 Jul, 2010 2 commits
  13. 24 Jul, 2010 1 commit
  14. 26 Jul, 2010 2 commits
    • Sven Sandberg's avatar
      merged BUG#55322 to 5.1-bugteam · 93324cbf
      Sven Sandberg authored
      93324cbf
    • Alexander Barkov's avatar
      Bug#45012 my_like_range_cp932 generates invalid string · e497d6e6
      Alexander Barkov authored
      Problem: The functions my_like_range_xxx() returned
      badly formed maximum strings for Asian character sets,
      which made problems for storage engines.
      
      Fix: 
      - Removed a number my_like_range_xxx() implementations,
        which were in fact dumplicate code pieces.
      - Using generic my_like_range_mb() instead.
      - Setting max_sort_char member properly for Asian character sets
      - Adding unittest/strings/strings-t.c, 
        to test that my_like_range_xxx() return well-formed 
        min and max strings.
      
      Notes:
      
      - No additional tests in mysql/t/ available.
        Old tests cover the affected code well enough.
      e497d6e6
  15. 23 Jul, 2010 4 commits
    • Vasil Dimov's avatar
      Increment InnoDB Plugin version to 1.0.11. · 6af3c0f9
      Vasil Dimov authored
      InnoDB Plugin 1.0.10 has been released with MySQL 5.1.49.
      6af3c0f9
    • Alexey Kopytov's avatar
      Bug #54476: crash when group_concat and 'with rollup' in · bb3fbba1
      Alexey Kopytov authored
                           prepared statements
      
      Using GROUP_CONCAT() together with the WITH ROLLUP modifier
      could crash the server.
      
      The reason was a combination of several facts:
      
      1. The Item_func_group_concat class stores pointers to ORDER
      objects representing the columns in the ORDER BY clause of
      GROUP_CONCAT().
      
      2. find_order_in_list() called from
      Item_func_group_concat::setup() modifies the ORDER objects so
      that their 'item' member points to the arguments list
      allocated in the Item_func_group_concat constructor.
      
      3. In some cases (e.g. in JOIN::rollup_make_fields) a copy of
      the original Item_func_group_concat object could be created by
      using the Item_func_group_concat::Item_func_group_concat(THD
      *thd, Item_func_group_concat *item) copy constructor. The
      latter essentially creates a shallow copy of the source
      object. Memory for the arguments array is allocated on
      thd->mem_root, but the pointers for arguments and ORDER are
      copied verbatim.
      
      What happens in the test case is that when executing the query
      for the first time, after a copy of the original
      Item_func_group_concat object has been created by
      JOIN::rollup_make_fields(), find_order_in_list() is called for
      this new object. It then resolves ORDER BY by modifying the
      ORDER objects so that they point to elements of the arguments
      array which is local to the cloned object. When thd->mem_root
      is freed upon completing the execution, pointers in the ORDER
      objects become invalid. Those ORDER objects, however, are also
      shared with the original Item_func_group_concat object which is
      preserved between executions of a prepared statement. So the
      first call to find_order_in_list() for the original object on
      the second execution tries to dereference an invalid pointer.
      
      The solution is to create copies of the ORDER objects when
      copying Item_func_group_concat to not leave any stale pointers
      in other instances with different lifecycles.
      bb3fbba1
    • Dmitry Shulga's avatar
      Merge 5.1-bugteam -> 5.1-bug-42496 · 32372a75
      Dmitry Shulga authored
      32372a75
    • Vasil Dimov's avatar
      Merge mysql-5.1 -> mysql-5.1-innodb · 10870186
      Vasil Dimov authored
      10870186
  16. 22 Jul, 2010 2 commits
  17. 21 Jul, 2010 1 commit