1. 25 Aug, 2008 2 commits
    • Davi Arnaut's avatar
      Bug#36579 Dumping information about locks in use may lead to a server crash · 1ee4a3ac
      Davi Arnaut authored
      Dumping information about locks in use by sending a SIGHUP signal
      to the server or by invoking the "mysqladmin debug" command may
      lead to a server crash in debug builds or to undefined behavior in
      production builds.
      
      The problem was that a mutex that protects a lock object (THR_LOCK)
      might have been destroyed before the lock object was actually removed
      from the list of locks in use, causing a race condition with other
      threads iterating over the list. The solution is to destroy the mutex
      only after removing lock object from the list.
      
      mysys/thr_lock.c:
        Destroy the mutex that protects the lock object only after removing
        the lock object from the list of locks in use.
      1ee4a3ac
    • Sergey Glukhov's avatar
      Bug#37428 Potential security issue with UDFs - linux shellcode execution. · c546559a
      Sergey Glukhov authored
      plugin_dir option backported from 5.1
      
      mysql-test/r/udf.result:
        result fix
      sql/mysql_priv.h:
        opt_plugin_dir and opt_plugin_dir_ptr declared.
      sql/mysqld.cc:
        'plugin_dir' option added
      sql/set_var.cc:
        'plugin_dir' option added.
      sql/sql_udf.cc:
        opt_plugin_dir added to the udf->dl path. Warn if it's not specified.
      sql/unireg.h:
        PLUGINDIR defined.
      c546559a
  2. 20 Aug, 2008 1 commit
    • Sergey Glukhov's avatar
      Bug#38291 memory corruption and server crash with view/sp/function · de73b729
      Sergey Glukhov authored
      Send_field.org_col_name has broken value on secondary execution.
      It happens when result field is created from the field which belongs to view
      due to forgotten assignment of some Send_field attributes. 
      The fix:
      set Send_field.org_col_name,org_table_name with correct value during Send_field intialization.
      
      mysql-test/r/metadata.result:
        result fix
        The result file was changed because now forgotten attributes are properly set.
      mysql-test/r/sp.result:
        test result
      mysql-test/t/sp.test:
        test case
      sql/item.cc:
        Send_field.org_col_name has broken value on secondary execution.
        It happens when result field is created from the field which belongs to view
        due to forgotten assignment of some Send_field attributes. 
        The fix:
        set Send_field.org_col_name,org_table_name with correct value during Send_field intialization.
      tests/mysql_client_test.c:
        test case fix
        The test was changed because now forgotten attributes are properly set.
      de73b729
  3. 19 Aug, 2008 2 commits
  4. 18 Aug, 2008 4 commits
  5. 15 Aug, 2008 4 commits
    • Chad MILLER's avatar
      Bug#37301 Length and Max_length differ with no obvious reason(2nd version) · 21598ea0
      Chad MILLER authored
      Length value is the length of the field,
      Max_length is the length of the field value.
      So Max_length can not be more than Length.
      The fix: fixed calculation of the Item_empty_string item length
      
      (Patch applied and queued on demand of Trudy/Davi.)
      
      sql/item.h:
        fixed calculation of the item length
      sql/sql_show.cc:
        removed unnecessary code
      21598ea0
    • Chad MILLER's avatar
      Bug#36270: incorrect calculation result - works in 4.1 but not in 5.0 or 5.1 · 65c3870c
      Chad MILLER authored
      When the fractional part in a multiplication of DECIMALs
      overflowed, we truncated the first operand rather than the
      longest. Now truncating least significant places instead
      for more precise multiplications.
      
      (Queuing at demand of Trudy/Davi.)
      
      mysql-test/r/type_newdecimal.result:
        show that if we need to truncate the scale of an operand, we pick the
        right one (that is, we discard the least significant decimal places)
      mysql-test/t/type_newdecimal.test:
        show that if we need to truncate the scale of an operand, we pick the
        right one (that is, we discard the least significant decimal places)
      strings/decimal.c:
        when needing to disregard fractional parts, pick the least
        significant ones
      65c3870c
    • Chad MILLER's avatar
    • Ramil Kalimullin's avatar
      Fix for bug #34779: crash in checksum table on federated tables · 2b179caf
      Ramil Kalimullin authored
      with blobs containing nulls
      
      Problem: FEDERATED SE improperly stores NULL fields in the record buffer.
      
      Fix: store them properly.
      
      
      mysql-test/r/federated.result:
        Fix for bug #34779: crash in checksum table on federated tables 
        with blobs containing nulls
          - test result.
      mysql-test/t/federated.test:
        Fix for bug #34779: crash in checksum table on federated tables 
        with blobs containing nulls
          - test case.
      sql/ha_federated.cc:
        Fix for bug #34779: crash in checksum table on federated tables 
        with blobs containing nulls
          - storing a NULL field in the record buffer
            we must initialize its data as other code
            may rely on it.
      2b179caf
  6. 14 Aug, 2008 1 commit
  7. 13 Aug, 2008 4 commits
    • Evgeny Potemkin's avatar
      Bug#38195: Incorrect handling of aggregate functions when loose index scan is · b789b4f3
      Evgeny Potemkin authored
      used causes server crash.
      
      When the loose index scan access method is used values of aggregated functions
      are precomputed by it. Aggregation of such functions shouldn't be performed
      in this case and functions should be treated as normal ones.
      The create_tmp_table function wasn't taking this into account and this led to
      a crash if a query has MIN/MAX aggregate functions and employs temporary table
      and loose index scan.
      Now the JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
      functions as normal ones when the loose index scan is used.
      
      
      mysql-test/r/group_min_max.result:
        Added a test case for the bug#38195.
      mysql-test/t/group_min_max.test:
        Added a test case for the bug#38195.
      sql/sql_select.cc:
        Bug#38195: Incorrect handling of aggregate functions when loose index scan is
        used causes server crash.
        Now the JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
        functions as normal ones when the loose index scan is used.
      b789b4f3
    • Joerg Bruehe's avatar
      Correct the version number to 5.0.70. · 182b2383
      Joerg Bruehe authored
      configure.in:
        Version number raise was incomplete, the 5.0 tree steps by 2.
      182b2383
    • unknown's avatar
      Raise version number after cloning 5.0.68 · 6cab759d
      unknown authored
      6cab759d
    • Timothy Smith's avatar
      Merge some 5.0 innodb changes · d7c36eb3
      Timothy Smith authored
      d7c36eb3
  8. 12 Aug, 2008 2 commits
  9. 11 Aug, 2008 9 commits
    • Davi Arnaut's avatar
      Bug#38486: Crash when using cursor protocol · 1912eaac
      Davi Arnaut authored
      Post-merge fix: mysql_client_test.c is compiled by C compilers
      and some C compilers don't support mixed declarations and code
      and it's explicitly forbidden by ISO C90.
      
      tests/mysql_client_test.c:
        Don't mix declarations and code.
      1912eaac
    • Marc Alff's avatar
      Merge mysql-5.0-bugteam -> local bugfix branch · 2f3b8603
      Marc Alff authored
      2f3b8603
    • Marc Alff's avatar
      Bug#37302 (missing DBUG_RETURN macro in function "find_key_block" (5.0 only)) · b4418b5c
      Marc Alff authored
      Fixed missing DBUG_RETURN in the function find_key_block
      b4418b5c
    • Chad MILLER's avatar
      Merge from bugteam 5.0 trunk. · 26ed51d0
      Chad MILLER authored
      26ed51d0
    • Marc Alff's avatar
      Bug#38296 (low memory crash with many conditions in a query) · e04dfffb
      Marc Alff authored
      This fix is for 5.0 only : back porting the 6.0 patch manually
      
      The parser code in sql/sql_yacc.yy needs to be more robust to out of
      memory conditions, so that when parsing a query fails due to OOM,
      the thread gracefully returns an error.
      
      Before this fix, a new/alloc returning NULL could:
      - cause a crash, if dereferencing the NULL pointer,
      - produce a corrupted parsed tree, containing NULL nodes,
      - alter the semantic of a query, by silently dropping token values or nodes
      
      With this fix:
      - C++ constructors are *not* executed with a NULL "this" pointer
      when operator new fails.
      This is achieved by declaring "operator new" with a "throw ()" clause,
      so that a failed new gracefully returns NULL on OOM conditions.
      
      - calls to new/alloc are tested for a NULL result,
      
      - The thread diagnostic area is set to an error status when OOM occurs.
      This ensures that a request failing in the server properly returns an
      ER_OUT_OF_RESOURCES error to the client.
      
      - OOM conditions cause the parser to stop immediately (MYSQL_YYABORT).
      This prevents causing further crashes when using a partially built parsed
      tree in further rules in the parser.
      
      No test scripts are provided, since automating OOM failures is not
      instrumented in the server.
      Tested under the debugger, to verify that an error in alloc_root cause the
      thread to returns gracefully all the way to the client application, with
      an ER_OUT_OF_RESOURCES error.
      e04dfffb
    • Chad MILLER's avatar
      b615e3d5
    • Davi Arnaut's avatar
      Post-merge fix: Silence warning due to type mismatch. · d622b04f
      Davi Arnaut authored
      client/mysql_upgrade.c:
        Silence warning due to type mismatch.
      d622b04f
    • Kristofer Pettersson's avatar
      Automerge · 861c06f0
      Kristofer Pettersson authored
      861c06f0
    • Kristofer Pettersson's avatar
      Bug#38486 Crash when using cursor protocol · 75a5ecbd
      Kristofer Pettersson authored
                  
      Server side cursors were not initialized properly and this caused a reference to
      uninitialized memory.
      75a5ecbd
  10. 08 Aug, 2008 1 commit
    • Timothy Smith's avatar
      Cherry-pick fix for Bug#35220 from innodb-5.0-ss2475 snapshot. · 9d9fa39b
      Timothy Smith authored
      Bug#35220: ALTER TABLE too picky on reserved word "foreign"
      
      In ALTER TABLE, change the internal parser to search for
      ``FOREIGN[[:space:]]'' instead of only ``FOREIGN'' when parsing
      ALTER TABLE ... DROP FOREIGN KEY ...; otherwise it could be mistaken
      with ALTER TABLE ... DROP foreign_col;
      
      (This fix is already present in MySQL 5.1 and higher.)
      9d9fa39b
  11. 07 Aug, 2008 1 commit
    • Chad MILLER's avatar
      Bug#31605: mysql_upgrade relies on Linux /proc filesystem when not \ · abeda651
      Chad MILLER authored
      	running on Windows
      
      We used two OS-specific methods of looking up the executable 
      name, which don't work outside of those two kinds of OSes 
      (Linux+Solaris and Windows).
      
      We assume that if the user ran this program with a certain 
      name, we can run the other sibling programs with a similar name.
      
      (re-patch in bzr)
      abeda651
  12. 06 Aug, 2008 3 commits
  13. 04 Aug, 2008 1 commit
  14. 31 Jul, 2008 2 commits
    • Timothy Smith's avatar
      Cherry-pick InnoDB fixes for Bug#34286, Bug#35352, and Bug#36600 from snapshot · dc593c3e
      Timothy Smith authored
      innodb-5.0-ss2475.
      
      Bug #34286  Assertion failure in thread 2816 in file .\row\row0sel.c line 3500
      Since autoinc init performs a MySQL SELECT query to determine the auto-inc
      value, set prebuilt->sql_stat_start = TRUE so that it is performed like any
      normal SELECT, regardless of the context in which it was invoked.
      
      
      Bug #35352  If InnoDB crashes with UNDO slots full error the error persists on restart
      We've added a heuristic that checks the size of the UNDO slots cache lists
      (insert and upate). If either of cached lists has more than 500 entries then we
      add any UNDO slots that are freed, to the common free list instead of the cache
      list, this is to avoid the case where all the free slots end up in only one of
      the lists on startup after a crash.
      
      Tested with test case for 26590 and passes all mysql-test(s).
      
      Bug #36600  SHOW STATUS takes a lot of CPU in buf_get_latched_pages_number
      Fixed by removing the Innodb_buffer_pool_pages_latched variable from SHOW
      STATUS output in non-UNIV_DEBUG compilation.
      
      dc593c3e
    • Georgi Kodinov's avatar
      Bug#34159: mysql_install_db fails with sql_mode=TRADITIONAL · b1915525
      Georgi Kodinov authored
            
      Reset session sql_mode before creating system tables as it
      is done in the mysql_fix_privilege_tables.sql script.
      
      scripts/mysql_system_tables.sql:
        reset sql mode
      b1915525
  15. 30 Jul, 2008 1 commit
    • Georgi Kodinov's avatar
      Bug#37662 nested if() inside sum() is parsed in exponential time · ae4a35fd
      Georgi Kodinov authored
            
      min() and max() functions are implemented in MySQL as macros.
      This means that max(a,b) is expanded to: ((a) > (b) ? (a) : (b))
      Note how 'a' is quoted two times.
      Now imagine 'a' is a recursive function call that's several 10s of levels deep.
      And the recursive function does max() with a function arg as well to dive into
      recursion.
      This means that simple function call can take most of the clock time.
      Identified and fixed several such calls to max()/min() : including the IF() 
      sql function implementation.
      
      mysql-test/r/func_if.result:
        Bug#37662 test case
      mysql-test/t/func_if.test:
        Bug#37662 test case
      sql/item.cc:
        Bug#37662 don't call expensive functions as arguments to min/max
      sql/item_cmpfunc.cc:
        Bug#37662 don't call expensive functions as arguments to min/max
      sql/item_func.cc:
        Bug#37662 don't call expensive functions as arguments to min/max
      ae4a35fd
  16. 29 Jul, 2008 2 commits