1. 02 Aug, 2010 3 commits
  2. 01 Aug, 2010 1 commit
    • Gleb Shchepa's avatar
      Bug #54461: crash with longblob and union or update with subquery · 38165ce4
      Gleb Shchepa authored
      Queries may crash, if
        1) the GREATEST or the LEAST function has a mixed list of
           numeric and LONGBLOB arguments and
        2) the result of such a function goes through an intermediate
           temporary table.
      
      An Item that references a LONGBLOB field has max_length of
      UINT_MAX32 == (2^32 - 1).
      
      The current implementation of GREATEST/LEAST returns REAL
      result for a mixed list of numeric and string arguments (that
      contradicts with the current documentation, this contradiction
      was discussed and it was decided to update the documentation).
      
      The max_length of such a function call was calculated as a
      maximum of argument max_length values (i.e. UINT_MAX32).
      
      That max_length value of UINT_MAX32 was used as a length for
      the intermediate temporary table Field_double to hold
      GREATEST/LEAST function result.
      
      The Field_double::val_str() method call on that field
      allocates a String value.
      
      Since an allocation of String reserves an additional byte
      for a zero-termination, the size of String buffer was
      set to (UINT_MAX32 + 1), that caused an integer overflow:
      actually, an empty buffer of size 0 was allocated.
      
      An initialization of the "first" byte of that zero-size
      buffer with '\0' caused a crash.
      
      The Item_func_min_max::fix_length_and_dec() has been
      modified to calculate max_length for the REAL result like
      we do it for arithmetical operators.
      
      
      ******
      Bug #54461: crash with longblob and union or update with subquery
      
      Queries may crash, if
        1) the GREATEST or the LEAST function has a mixed list of
           numeric and LONGBLOB arguments and
        2) the result of such a function goes through an intermediate
           temporary table.
      
      An Item that references a LONGBLOB field has max_length of
      UINT_MAX32 == (2^32 - 1).
      
      The current implementation of GREATEST/LEAST returns REAL
      result for a mixed list of numeric and string arguments (that
      contradicts with the current documentation, this contradiction
      was discussed and it was decided to update the documentation).
      
      The max_length of such a function call was calculated as a
      maximum of argument max_length values (i.e. UINT_MAX32).
      
      That max_length value of UINT_MAX32 was used as a length for
      the intermediate temporary table Field_double to hold
      GREATEST/LEAST function result.
      
      The Field_double::val_str() method call on that field
      allocates a String value.
      
      Since an allocation of String reserves an additional byte
      for a zero-termination, the size of String buffer was
      set to (UINT_MAX32 + 1), that caused an integer overflow:
      actually, an empty buffer of size 0 was allocated.
      
      An initialization of the "first" byte of that zero-size
      buffer with '\0' caused a crash.
      
      The Item_func_min_max::fix_length_and_dec() has been
      modified to calculate max_length for the REAL result like
      we do it for arithmetical operators.
      38165ce4
  3. 30 Jul, 2010 9 commits
  4. 28 Jul, 2010 1 commit
    • Davi Arnaut's avatar
      Bug#53463: YaSSL patch appears to be reverted · ccf6ec09
      Davi Arnaut authored
      The problem is that the fix Bug#29784 was mistakenly
      reverted when updating YaSSL to a newer version.
      
      The solution is to re-apply the fix and this time
      actually add a meaningful test case so that possible
      regressions are caught.
      ccf6ec09
  5. 29 Jul, 2010 4 commits
    • Vasil Dimov's avatar
      Merge mysql-5.1-innodb -> mysql-5.1-bugteam · 2aee4d8d
      Vasil Dimov authored
      2aee4d8d
    • Vasil Dimov's avatar
      Merge mysql-5.1-bugteam -> mysql-5.1-innodb · a95441c0
      Vasil Dimov authored
      a95441c0
    • Alexander Barkov's avatar
      Postfix for BUG#45012. · c7071a72
      Alexander Barkov authored
      Problem: The original patch didn't compile on debug_werror
      due to wrong format in printf("%d") for size_t variables.
      
      Fix: Adding cast to (int).
      c7071a72
    • 's avatar
      BUG#49124 Security issue with /*!-versioned */ SQL statements on Slave · 2ad690fd
      authored
      /*![:version:] Query Code */, where [:version:] is a sequence of 5 
      digits representing the mysql server version(e.g /*!50200 ... */),
      is a special comment that the query in it can be executed on those 
      servers whose versions are larger than the version appearing in the 
      comment. It leads to a security issue when slave's version is larger 
      than master's. A malicious user can improve his privileges on slaves. 
      Because slave SQL thread is running with SUPER privileges, so it can
      execute queries that he/she does not have privileges on master.
      
      This bug is fixed with the logic below: 
      - To replace '!' with ' ' in the magic comments which are not applied on
        master. So they become common comments and will not be applied on slave.
      
      - Example:
        'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
        will be binlogged as
        'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/
      2ad690fd
  6. 28 Jul, 2010 1 commit
  7. 24 Jul, 2010 1 commit
  8. 26 Jul, 2010 2 commits
    • Sven Sandberg's avatar
      merged BUG#55322 to 5.1-bugteam · 93324cbf
      Sven Sandberg authored
      93324cbf
    • Alexander Barkov's avatar
      Bug#45012 my_like_range_cp932 generates invalid string · e497d6e6
      Alexander Barkov authored
      Problem: The functions my_like_range_xxx() returned
      badly formed maximum strings for Asian character sets,
      which made problems for storage engines.
      
      Fix: 
      - Removed a number my_like_range_xxx() implementations,
        which were in fact dumplicate code pieces.
      - Using generic my_like_range_mb() instead.
      - Setting max_sort_char member properly for Asian character sets
      - Adding unittest/strings/strings-t.c, 
        to test that my_like_range_xxx() return well-formed 
        min and max strings.
      
      Notes:
      
      - No additional tests in mysql/t/ available.
        Old tests cover the affected code well enough.
      e497d6e6
  9. 23 Jul, 2010 4 commits
    • Vasil Dimov's avatar
      Increment InnoDB Plugin version to 1.0.11. · 6af3c0f9
      Vasil Dimov authored
      InnoDB Plugin 1.0.10 has been released with MySQL 5.1.49.
      6af3c0f9
    • Alexey Kopytov's avatar
      Bug #54476: crash when group_concat and 'with rollup' in · bb3fbba1
      Alexey Kopytov authored
                           prepared statements
      
      Using GROUP_CONCAT() together with the WITH ROLLUP modifier
      could crash the server.
      
      The reason was a combination of several facts:
      
      1. The Item_func_group_concat class stores pointers to ORDER
      objects representing the columns in the ORDER BY clause of
      GROUP_CONCAT().
      
      2. find_order_in_list() called from
      Item_func_group_concat::setup() modifies the ORDER objects so
      that their 'item' member points to the arguments list
      allocated in the Item_func_group_concat constructor.
      
      3. In some cases (e.g. in JOIN::rollup_make_fields) a copy of
      the original Item_func_group_concat object could be created by
      using the Item_func_group_concat::Item_func_group_concat(THD
      *thd, Item_func_group_concat *item) copy constructor. The
      latter essentially creates a shallow copy of the source
      object. Memory for the arguments array is allocated on
      thd->mem_root, but the pointers for arguments and ORDER are
      copied verbatim.
      
      What happens in the test case is that when executing the query
      for the first time, after a copy of the original
      Item_func_group_concat object has been created by
      JOIN::rollup_make_fields(), find_order_in_list() is called for
      this new object. It then resolves ORDER BY by modifying the
      ORDER objects so that they point to elements of the arguments
      array which is local to the cloned object. When thd->mem_root
      is freed upon completing the execution, pointers in the ORDER
      objects become invalid. Those ORDER objects, however, are also
      shared with the original Item_func_group_concat object which is
      preserved between executions of a prepared statement. So the
      first call to find_order_in_list() for the original object on
      the second execution tries to dereference an invalid pointer.
      
      The solution is to create copies of the ORDER objects when
      copying Item_func_group_concat to not leave any stale pointers
      in other instances with different lifecycles.
      bb3fbba1
    • Dmitry Shulga's avatar
      Merge 5.1-bugteam -> 5.1-bug-42496 · 32372a75
      Dmitry Shulga authored
      32372a75
    • Vasil Dimov's avatar
      Merge mysql-5.1 -> mysql-5.1-innodb · 10870186
      Vasil Dimov authored
      10870186
  10. 22 Jul, 2010 2 commits
  11. 21 Jul, 2010 11 commits
  12. 20 Jul, 2010 1 commit
    • Davi Arnaut's avatar
      Bug#45288: pb2 returns a lot of compilation warnings on linux · c96b249f
      Davi Arnaut authored
      Fix warnings flagged by the new warning option -Wunused-but-set-variable
      that was added to GCC 4.6 and that is enabled by -Wunused and -Wall. The
      option causes a warning whenever a local variable is assigned to but is
      later unused. It also warns about meaningless pointer dereferences.
      c96b249f