1. 13 Aug, 2010 3 commits
  2. 05 Aug, 2010 2 commits
    • Sunny Bains's avatar
      Fix Bug #55277 - Failing assertion: auto_inc > 0 · 6c0f9301
      Sunny Bains authored
      Handle overflow when reading value from SELECT MAX(C) FROM T;
      
      Call ha_innobase::info() after initializing the autoinc value
      in ha_innobase::open().
      
      Fix for both the builtin and plugin.
      
      rb://402
      6c0f9301
    • Sunny Bains's avatar
      Fix bug# 55543 - InnoDB Plugin: Signal 6: Assertion failure in file fil/fil0fil.c line 4306 · e19a4942
      Sunny Bains authored
      The bug is due to a double delete of a BLOB, once via:
      
          rollback -> btr_cur_pessimistic_delete()
      
      and the second time via purge.
      
      The bug is in row_upd_clust_rec_by_insert(). There we relinquish ownership
      of the non-updated BLOB columns in btr_cur_mark_extern_inherited_fields()
      before building the row entry that will be inserted and whose contents will
      be logged in the UNDO log. However, we don't set the BLOB column later to
      INHERITED so that a possible rollback will not free the original row's
      non-updated BLOB entries. This is because the condition that checks for
      that is in :
      
      	if (node->upd_ext) {}.
      
      node->upd_ext is non-NULL only if a BLOB column was updated and that column
      is part of some key ordering (see row_upd_replace()). This results in the
      non-update BLOB columns being deleted during a rollback and subsequently by
      purge again.
      
      rb://413
      e19a4942
  3. 04 Aug, 2010 6 commits
  4. 03 Aug, 2010 10 commits
  5. 02 Aug, 2010 6 commits
  6. 01 Aug, 2010 1 commit
    • Gleb Shchepa's avatar
      Bug #54461: crash with longblob and union or update with subquery · 38165ce4
      Gleb Shchepa authored
      Queries may crash, if
        1) the GREATEST or the LEAST function has a mixed list of
           numeric and LONGBLOB arguments and
        2) the result of such a function goes through an intermediate
           temporary table.
      
      An Item that references a LONGBLOB field has max_length of
      UINT_MAX32 == (2^32 - 1).
      
      The current implementation of GREATEST/LEAST returns REAL
      result for a mixed list of numeric and string arguments (that
      contradicts with the current documentation, this contradiction
      was discussed and it was decided to update the documentation).
      
      The max_length of such a function call was calculated as a
      maximum of argument max_length values (i.e. UINT_MAX32).
      
      That max_length value of UINT_MAX32 was used as a length for
      the intermediate temporary table Field_double to hold
      GREATEST/LEAST function result.
      
      The Field_double::val_str() method call on that field
      allocates a String value.
      
      Since an allocation of String reserves an additional byte
      for a zero-termination, the size of String buffer was
      set to (UINT_MAX32 + 1), that caused an integer overflow:
      actually, an empty buffer of size 0 was allocated.
      
      An initialization of the "first" byte of that zero-size
      buffer with '\0' caused a crash.
      
      The Item_func_min_max::fix_length_and_dec() has been
      modified to calculate max_length for the REAL result like
      we do it for arithmetical operators.
      
      
      ******
      Bug #54461: crash with longblob and union or update with subquery
      
      Queries may crash, if
        1) the GREATEST or the LEAST function has a mixed list of
           numeric and LONGBLOB arguments and
        2) the result of such a function goes through an intermediate
           temporary table.
      
      An Item that references a LONGBLOB field has max_length of
      UINT_MAX32 == (2^32 - 1).
      
      The current implementation of GREATEST/LEAST returns REAL
      result for a mixed list of numeric and string arguments (that
      contradicts with the current documentation, this contradiction
      was discussed and it was decided to update the documentation).
      
      The max_length of such a function call was calculated as a
      maximum of argument max_length values (i.e. UINT_MAX32).
      
      That max_length value of UINT_MAX32 was used as a length for
      the intermediate temporary table Field_double to hold
      GREATEST/LEAST function result.
      
      The Field_double::val_str() method call on that field
      allocates a String value.
      
      Since an allocation of String reserves an additional byte
      for a zero-termination, the size of String buffer was
      set to (UINT_MAX32 + 1), that caused an integer overflow:
      actually, an empty buffer of size 0 was allocated.
      
      An initialization of the "first" byte of that zero-size
      buffer with '\0' caused a crash.
      
      The Item_func_min_max::fix_length_and_dec() has been
      modified to calculate max_length for the REAL result like
      we do it for arithmetical operators.
      38165ce4
  7. 31 Jul, 2010 3 commits
  8. 30 Jul, 2010 9 commits
    • Davi Arnaut's avatar
      Revert revision which disabled the generating of configuration · b5c8757a
      Davi Arnaut authored
      scripts if cmake is available. We need to always generate the
      scripts in order for the dual cmake/autotools support to work.
      b5c8757a
    • Davi Arnaut's avatar
      Bug#45288: pb2 returns a lot of compilation warnings on linux · e260cc3f
      Davi Arnaut authored
      Fix compiler warnings.
      e260cc3f
    • Alexander Nozdrin's avatar
      Update .bzrignore. · d285d75d
      Alexander Nozdrin authored
      d285d75d
    • Alexander Nozdrin's avatar
      Auto-merge from mysql-trunk-bugfixing. · b2f80050
      Alexander Nozdrin authored
      ******
      This patch fixes the following bugs:
        - Bug#5889: Exit handler for a warning doesn't hide the warning in
          trigger
        - Bug#9857: Stored procedures: handler for sqlwarning ignored
        - Bug#23032: Handlers declared in a SP do not handle warnings generated
          in sub-SP
        - Bug#36185: Incorrect precedence for warning and exception handlers
      
      The problem was in the way warnings/errors during stored routine execution
      were handled. Prior to this patch the logic was as follows:
      
        - when a warning/an error happens: if we're executing a stored routine,
          and there is a handler for that warning/error, remember the handler,
          ignore the warning/error and continue execution.
      
        - after a stored routine instruction is executed: check for a remembered
          handler and activate one (if any).
      
      This logic caused several problems:
      
        - if one instruction generates several warnings (errors) it's impossible
          to choose the right handler -- a handler for the first generated
          condition was chosen and remembered for activation.
      
        - mess with handling conditions in scopes different from the current one.
      
        - not putting generated warnings/errors into Warning Info (Diagnostic
          Area) is against The Standard.
      
      The patch changes the logic as follows:
      
        - Diagnostic Area is cleared on the beginning of each statement that
          either is able to generate warnings, or is able to work with tables.
      
        - at the end of a stored routine instruction, Diagnostic Area is left
          intact.
      
        - Diagnostic Area is checked after each stored routine instruction. If
          an instruction generates several condition, it's now possible to take a
          look at all of them and determine an appropriate handler.
      b2f80050
    • Alexander Nozdrin's avatar
      Auto-merge from mysql-trunk-bugfixing. · 02a0787d
      Alexander Nozdrin authored
      02a0787d
    • Luis Soares's avatar
    • Luis Soares's avatar
      abbcf12e
    • Luis Soares's avatar
      70928da9
    • Georgi Kodinov's avatar
      null merge · b4f1c833
      Georgi Kodinov authored
      b4f1c833