mariadb

Commit Graph

Author	SHA1	Message	Date
Sergey Glukhov	47885f552b	Bug#11766087 59125: VALGRIND UNINITIALISED VALUE WARNING IN ULL2DEC, LONGLONG2DECIMAL Valgrind warning happens due to missing NULL value check in Item_func::val_decimal. The fix is to add this check. mysql-test/r/func_time.result: test case mysql-test/t/func_time.test: test case sql/item_func.cc: added check for NULL value	15 years ago
Sergey Glukhov	9d1c240ac2	Bug#11766087 59125: VALGRIND UNINITIALISED VALUE WARNING IN ULL2DEC, LONGLONG2DECIMAL Valgrind warning happens due to missing NULL value check in Item_func::val_decimal. The fix is to add this check.	15 years ago
Sergey Glukhov	a88faf2a4a	Bug#11764994 57900: CREATE TABLE .. SELECT ASSERTS SCALE >= 0 && PRECISION > 0 && SCALE <= PR Assert fails due to overflow which happens in Item_func_int_val::fix_num_length_and_dec() as geometry functions have max_length value equal to max_field_size(4294967295U). The fix is to skip max_length calculation for some boundary cases. mysql-test/r/func_math.result: test case mysql-test/t/func_math.test: test case sql/item_func.cc: skip max_length calculation if argument max_length is near max_field_size.	15 years ago
Sergey Glukhov	86c1225699	Bug#11764994 57900: CREATE TABLE .. SELECT ASSERTS SCALE >= 0 && PRECISION > 0 && SCALE <= PR Assert fails due to overflow which happens in Item_func_int_val::fix_num_length_and_dec() as geometry functions have max_length value equal to max_field_size(4294967295U). The fix is to skip max_length calculation for some boundary cases.	15 years ago
Sergey Glukhov	ff23f5360e	Bug#11766424 59527: DECIMAL_BIN_SIZE: ASSERTION `SCALE >= 0 && PRECISION > 0 && SCALE <= PRE Assertion happens due to missing initialization of unsigned_flag for Item_func_set_user_var object. It leads to incorrect calculation of decimal field size. The fix is to add initialization of unsigned_flag. mysql-test/r/variables.result: test case mysql-test/t/variables.test: test case sql/item_func.cc: add initialization of unsigned_flag.	15 years ago
Sergey Glukhov	b6c56f465c	Bug#11766424 59527: DECIMAL_BIN_SIZE: ASSERTION `SCALE >= 0 && PRECISION > 0 && SCALE <= PRE Assertion happens due to missing initialization of unsigned_flag for Item_func_set_user_var object. It leads to incorrect calculation of decimal field size. The fix is to add initialization of unsigned_flag.	15 years ago
unknown	ec23949158	Fix LP BUG#715738 Analysis: A query with implicit grouping is one with aggregate functions and no GROUP BY clause. MariaDB inherits from MySQL an SQL extenstion that allows mixing aggregate functions with non-aggregate fields. If a query with such mixed select clause produces an empty result set, the meaning of aggregate functions is well defined - either NULL (MIN, MAX, etc.), or 0 (count(*)). However the non-aggregated fields must also have some value, and the only reasonable value in the case of empty result is NULL. The cause of the many wrong results was that if a field is declared as non-nullable (e.g. because it is a PK or NOT NULL), the semantic analysis and the optimization phases treat this field as non-nullable, and generate all related query plan elements based on this assumption. Later during execution, these incorrectly configured/generated query plan elements result in a wrong result because the selected fields are not null due to the not-null assumption during optimization. Solution: Detect before the context analysys phase that a query uses implicit grouping with mixed aggregates/non-aggregates, and set all fields as nullable. The parser already walks the SELECT clause, and already sets Item::with_sum_func for Items that reference aggreagate functions. The patch adds a symmetric Item::with_field so that all Items that reference an Item_field are marked during their construction at parse time in the same way as with aggregate function use.	15 years ago
Sergei Golubchik	a67bf98f02	lp:738067 Crash in get_datetime_value() in 5.1-micro	15 years ago
Sergei Golubchik	5122e43a93	lp:737450 Second Assertion `item->null_value' failed in 5.1-micro implement Item_func_min_max::get_date()	15 years ago
Sergei Golubchik	d72f05fc5b	lp:736791 Crash in make_truncated_value_warningwith LEAST()/GREATEST/COALESCE and a test case for lp:736370 Datetime functions in subquery context cause wrong result	15 years ago
Jorgen Loland	4015719c01	BUG#11766317: FIND_IN_SET won't work normaly after upgrade from 5.1 to 5.5 (Former 59405) In this bug, args[0] in an Item_func_find_in_set stored an Item_func_weekday that was constant. In Item_func_find_in_set::fix_length_and_dec(), args[0]->val_str() was called. Later, when Item_func_find_in_set::val_int() was called, args[0]->null_value was checked. However, the Item_func_weekday in args[0] had now been replaced with an Item_cache. No val_*() calls had been made to this Item_cache, thus null_value was incorrectly 'true', resulting in missing rows in the result set. enum_value gets a value in fix_length_and_dec() iff args[0] is both constant and non-null. It is therefore unnecessary to check the null_value of args[0] in val_int(). An alternative fix would be to call args[0]->val_int() inside Item_func_find_in_set::val_int(). This would ensure args[0]->null_value was set correctly (always false in this case), but that would have to be done for every record this const value is checked against. mysql-test/r/func_set.result: Add test for BUG#59405 mysql-test/t/func_set.test: Add test for BUG#59405	15 years ago
Jorgen Loland	40d72add32	BUG#11766317: FIND_IN_SET won't work normaly after upgrade from 5.1 to 5.5 (Former 59405) In this bug, args[0] in an Item_func_find_in_set stored an Item_func_weekday that was constant. In Item_func_find_in_set::fix_length_and_dec(), args[0]->val_str() was called. Later, when Item_func_find_in_set::val_int() was called, args[0]->null_value was checked. However, the Item_func_weekday in args[0] had now been replaced with an Item_cache. No val_*() calls had been made to this Item_cache, thus null_value was incorrectly 'true', resulting in missing rows in the result set. enum_value gets a value in fix_length_and_dec() iff args[0] is both constant and non-null. It is therefore unnecessary to check the null_value of args[0] in val_int(). An alternative fix would be to call args[0]->val_int() inside Item_func_find_in_set::val_int(). This would ensure args[0]->null_value was set correctly (always false in this case), but that would have to be done for every record this const value is checked against.	15 years ago
Mikael Ronstrom	b14adc3921	More review fixes	15 years ago
Mikael Ronstrom	a41873670c	More review fixes	15 years ago
Alexander Barkov	1bc5e76efb	BUG#11766519 (bug#59648): MY_STRTOLL10_MB2: ASSERTION `(*ENDPTR - S) % 2 == 0' FAILED Problem: wrong character set pointer was passed to my_strtoll10_mb2, which led to DBUG_ASSERT failure in some cases. @ mysql-test/r/func_encrypt_ucs2.result @ mysql-test/t/func_encrypt_ucs2.test @ mysql-test/r/ctype_ucs.result @ mysql-test/t/ctype_ucs.test Adding tests @ sql/item_func.cc "cs" initialization was wrong (res does not necessarily point to &str_value) @ sql/item_strfunc.cc Item_func_dec_encrypt::val_str() and Item_func_des_descrypt::val_str() did not set character set for tmp_value (the returned value), so the old value, which was previously copied from args[1]->val_str(), was incorrectly returned with tmp_value.	15 years ago
Alexander Barkov	5956241859	BUG#11766519 (bug#59648): MY_STRTOLL10_MB2: ASSERTION `(*ENDPTR - S) % 2 == 0' FAILED Problem: wrong character set pointer was passed to my_strtoll10_mb2, which led to DBUG_ASSERT failure in some cases. @ mysql-test/r/func_encrypt_ucs2.result @ mysql-test/t/func_encrypt_ucs2.test @ mysql-test/r/ctype_ucs.result @ mysql-test/t/ctype_ucs.test Adding tests @ sql/item_func.cc "cs" initialization was wrong (res does not necessarily point to &str_value) @ sql/item_strfunc.cc Item_func_dec_encrypt::val_str() and Item_func_des_descrypt::val_str() did not set character set for tmp_value (the returned value), so the old value, which was previously copied from args[1]->val_str(), was incorrectly returned with tmp_value.	15 years ago
Michael Widenius	9aa44bb4b3	Fixed wrong alias usage	15 years ago
Sergei Golubchik	a8a757c6bb	wl#173 - temporal types with sub-second resolution and collateral changes. * introduce my_hrtime_t, my_timediff_t, and conversion macros * inroduce TIME_RESULT, but it can only be returned from Item::cmp_type(), never from Item::result_type() * pack_time/unpack_time function for "packed" representation of MYSQL_TIME in a longlong that can be compared * ADDTIME()/SUBTIME()/+- INTERVAL now work with TIME values * numbers aren't quoted in EXPLAIN EXTENDED * new column I_S.COLUMNS.DATETIME_PRECISION * date/time values are compares to anything as date/time, not as strings or numbers. * old timestamp(X) is no longer supported * MYSQL_TIME to string conversion functions take precision as an argument * unified the warnings from Field_timestamp/datetime/time/date/newdate store methods * Field_timestamp_hires, Field_datetime_hires, Field_time_hires * Field_temporal * Lazy_string class to pass a value (string, number, time) polymorphically down the stack * make_truncated_value_warning and Field::set_datetime_warning use Lazy_string as an argument, removed char/int/double variants removed Field::can_be_compared_as_longlong(). Use Field::cmp_type() == INT_RESULT instead * introduced Item::cmp_result() instead of Item::is_datetime() and Item::result_as_longlong() * in many cases date/time types are treated like other types, not as special cases * greatly simplified Arg_comparator (regarding date/time/year code) * SEC_TO_TIME is real function, not integer. * microsecond precision in NOW, CURTIME, etc * Item_temporal. All items derived from it only provide get_date, but no val* methods * replication of NOW(6) * Protocol::store(time) now takes the precision as an argument * @@TIMESTAMP is a double client/mysqlbinlog.cc: remove unneded casts include/my_sys.h: introduce my_hrtime_t, my_timediff_t, and conversion macros include/my_time.h: pack_time/unpack_time, etc. convenience functions to work with MYSQL_TIME::second_part libmysql/libmysql.c: str_to_time() is gone. str_to_datetime() does it now. my_TIME_to_str() takes the precision as an argument mysql-test/include/ps_conv.inc: time is not equal to datetime anymore mysql-test/r/distinct.result: a test for an old MySQL bug mysql-test/r/explain.result: numbers aren't quoted in EXPLAIN EXTENDED mysql-test/r/func_default.result: numbers aren't quoted in EXPLAIN EXTENDED mysql-test/r/func_sapdb.result: when decimals=NOT_FIXED_DEC it means "not fixed" indeed mysql-test/r/func_test.result: numbers aren't quoted in EXPLAIN EXTENDED mysql-test/r/func_time.result: ADDTIME()/SUBTIME()/+- INTERVAL now work with TIME values mysql-test/r/having.result: numbers aren't quoted in EXPLAIN EXTENDED mysql-test/r/information_schema.result: new column I_S.COLUMNS.DATETIME_PRECISION mysql-test/r/join_outer.result: numbers aren't quoted in EXPLAIN EXTENDED mysql-test/r/metadata.result: TIMESTAMP no longer has zerofill flag mysql-test/r/range.result: invalid datetime is not compared with as a string mysql-test/r/select.result: NO_ZERO_IN_DATE, etc only affect storage - according to the manual numbers aren't quoted in EXPLAIN EXTENDED mysql-test/r/subselect.result: numbers aren't quoted in EXPLAIN EXTENDED mysql-test/r/sysdate_is_now.result: when decimals=NOT_FIXED_DEC it means "not fixed" indeed mysql-test/r/type_blob.result: TIMESTAMP(N) is not deprecated mysql-test/r/type_timestamp.result: old TIMESTAMP(X) semantics is not supported anymore mysql-test/r/union.result: numbers aren't quoted in EXPLAIN EXTENDED mysql-test/r/varbinary.result: numbers aren't quoted in EXPLAIN EXTENDED mysql-test/t/distinct.test: test for an old MySQL bug mysql-test/t/func_time.test: +- INTERVAL now works with TIME values mysql-test/t/select.test: typo mysql-test/t/subselect.test: only one error per statement, please mysql-test/t/system_mysql_db_fix40123.test: old timestamp(X) is no longer supported mysql-test/t/system_mysql_db_fix50030.test: old timestamp(X) is no longer supported mysql-test/t/system_mysql_db_fix50117.test: old timestamp(X) is no longer supported mysql-test/t/type_blob.test: old timestamp(X) is no longer supported mysql-test/t/type_timestamp.test: old timestamp(X) is no longer supported mysys/my_getsystime.c: functions to get the time with microsecond precision mysys/my_init.c: move the my_getsystime.c initialization code to my_getsystime.c mysys/my_static.c: no need to make these variables extern mysys/my_static.h: no need to make these variables extern scripts/mysql_system_tables.sql: old timestamp(X) is no longer supported scripts/mysql_system_tables_fix.sql: old timestamp(X) is no longer supported scripts/mysqlhotcopy.sh: old timestamp(X) is no longer supported sql-common/my_time.c: * call str_to_time from str_to_datetime, as appropriate * date/time to string conversions take precision as an argument * number_to_time() * TIME_to_double() * pack_time() and unpack_time() sql/event_data_objects.cc: cast is not needed my_datetime_to_str() takes precision as an argument sql/event_db_repository.cc: avoid dangerous downcast (because the pointer is not always Field_timestamp, see events_1.test) sql/event_queue.cc: avoid silly double-work for cond_wait (having an endpoint of wait, subtract the current time to get the timeout, and use set_timespec() macro to fill in struct timespec, by adding the current time to the timeout) sql/field.cc: * remove virtual Field::get_time(), everyone should use only Field::get_date() * remove lots of #ifdef WORDS_BIGENDIAN * unified the warnings from Field_timestamp/datetime/time/date/newdate store methods * Field_timestamp_hires, Field_datetime_hires, Field_time_hires * Field_temporal * make_truncated_value_warning and Field::set_datetime_warning use Lazy_string as an argument, removed char/int/double variants sql/field.h: remove virtual Field::get_time(), everyone should use only Field::get_date() * remove lots of #ifdef WORDS_BIGENDIAN * unified the warnings from Field_timestamp/datetime/time/date/newdate store methods * Field_timestamp_hires, Field_datetime_hires, Field_time_hires * Field_temporal * make_truncated_value_warning and Field::set_datetime_warning use Lazy_string as an argument, removed char/int/double variants removed Field::can_be_compared_as_longlong(). Use Field::cmp_type() == INT_RESULT instead sql/filesort.cc: TIME_RESULT, cmp_time() sql/item.cc: * numbers aren't quoted in EXPLAIN EXTENDED * Item::cmp_result() instead of Item::is_datetime() and Item::result_as_longlong() * virtual Item::get_time() is gone * Item_param::field_type() is set correctly * Item_datetime, for a datetime constant * time to anything is compared as a time * Item_cache::print() prints the value is available * bug fixed in Item_cache_int::val_str() sql/item.h: * Item::print_value(), to be used from Item_xxx::print() when needed * Item::cmp_result() instead of Item::is_datetime() and Item::result_as_longlong() * virtual Item::get_time() is gone * Item_datetime, for a datetime constant * better default for cast_to_int_type() * Item_cache objects now always have the field_type() set sql/item_cmpfunc.cc: * get_year_value, get_time_value are gone. get_datetime_value does it all * get_value_a_func, get_value_b_func are gone * can_compare_as_dates() is gone too, TIME_RESULT is used instead * cmp_type() instead or result_type() when doing a comparison * compare_datetime and compate_e_datetime in the comparator_matrix, is_nulls_eq is gone * Item::cmp_result() instead of Item::is_datetime() and Item::result_as_longlong() sql/item_cmpfunc.h: greatly simplified Arg_comparator sql/item_create.cc: * fix a bug in error messages in CAST sql/item_func.cc: Item::cmp_result() instead of Item::is_datetime() and Item::result_as_longlong() mention all possibitiles in switch over Item_result values, or use default: sql/item_row.h: overwrite the default cmp_type() for Item_row, as no MYSQL_TYPE_xxx value corresponds to ROW_RESULT sql/item_timefunc.cc: rewrite make_datetime to support precision argument SEC_TO_TIME is real function, not integer. many functions that returned temporal values had duplicate code in val_* methods, some of them did not have get_date() which resulted in unnecessary date->str->date conversions. Now they all are derived from Item_temporal_func and only provide get_date, not val* methods. many fixes to set decimals (datetime precision) correctly. sql/item_timefunc.h: SEC_TO_TIME is real function, not integer. many functions that returned temporal values had duplicate code in val_* methods, some of them did not have get_date() which resulted in unnecessary date->str->date conversions. Now they all are derived from Item_temporal_func and only provide get_date, not val* methods. many fixes to set decimals (datetime precision) correctly. sql/log_event.cc: replication of NOW(6) sql/log_event.h: replication of NOW(6) sql/mysql_priv.h: Lazy_string class to pass a value (string, number, time) polymorphically down the stack. make_truncated_value_warning() that uses it. sql/mysqld.cc: datetime in Arg_comparator::comparator_matrix sql/opt_range.cc: cleanup: don't disable warnings before calling save_in_field_no_warnings() sql/protocol.cc: Protocol::store(time) now takes the precision as an argument sql/protocol.h: Protocol::store(time) now takes the precision as an argument sql/rpl_rli.cc: small cleanup sql/set_var.cc: SET TIMESTAMP=double sql/set_var.h: @@TIMESTAMP is a double sql/share/errmsg.txt: precision and scale are unsigned sql/slave.cc: replication of NOW(6) sql/sp_head.cc: cleanup sql/sql_class.cc: support for NOW(6) sql/sql_class.h: support for NOW(6) sql/sql_insert.cc: support for NOW(6) sql/sql_select.cc: use item->cmp_type(). move a comment where it belongs sql/sql_show.cc: new column I_S.COLUMNS.DATETIME_PRECISION sql/sql_yacc.yy: TIME(X), DATETIME(X), cast, NOW(X), CURTIME(X), etc sql/time.cc: fix date_add_interval() to support MYSQL_TIMESTAMP_TIME argument storage/myisam/ha_myisam.cc: TIMESTAMP no longer carries ZEROFIELD flag, still we keep MYI file compatible. strings/my_vsnprintf.c: warnings tests/mysql_client_test.c: old timestamp(X) does not work anymore datetime is no longer equal to time	15 years ago
Michael Widenius	ff3da0f963	Change TABLE->alias to String for less memory reallocation Changed some String.ptr() -> String.c_ptr() for String that are not guaranteed to end with \0 Removed some c_ptr() usage from parameters to functions that takes ptr & length Use preallocate buffers to avoid calling malloc() for most operations. sql/event_db_repository.cc: alias is now a String sql/event_scheduler.cc: c_ptr -> c_ptr_safe() to avoid warnings from valgrind. sql/events.cc: c_ptr -> c_ptr_safe() to avoid warnings from valgrind. c_ptr -> ptr() as function takes ptr & length sql/field.cc: alias is now a String sql/field.h: alias is now a String sql/ha_partition.cc: alias is now a String sql/handler.cc: alias is now a String ptr() -> c_ptr() as string is not guaranteed to be \0 terminated sql/item.cc: Store error parameter in separarte buffer to ensure correct error message sql/item_func.cc: ptr() -> c_ptr_safe() as string is not guaranteed to be \0 terminated sql/item_sum.h: Use my_strtod() instead of my_atof() to not have to make string \0 terminated sql/lock.cc: alias is now a String sql/log.cc: c_ptr() -> ptr() as function takes ptr & length sql/log_event.cc: c_ptr_quick() -> ptr() as we only want to get the pointer to String buffer sql/opt_range.cc: ptr() -> c_ptr() as string is not guaranteed to be \0 terminated sql/opt_table_elimination.cc: alias is now a String sql/set_var.cc: ptr() -> c_ptr() as string is not guaranteed to be \0 terminated c_ptr() -> c_ptr_safe() to avoid warnings from valgrind. c_ptr() -> ptr() as function takes ptr & length Simplify some code. sql/sp.cc: c_ptr() -> ptr() as function takes ptr & length sql/sp_rcontext.cc: alias is now a String sql/sql_base.cc: alias is now a String. Here we win a realloc() for most alias usage. sql/sql_class.cc: Use size descriptor for printf() to avoid accessing bytes outside of buffer sql/sql_insert.cc: Change allocation of TABLE as it's now contains a String _ptr() -> ptr() as function takes ptr & length sql/sql_load.cc: Use preallocate buffers to avoid calling malloc() for most operations. sql/sql_parse.cc: Use c_ptr_safe() to ensure string is \0 terminated. sql/sql_plugin.cc: c_ptr_quick() -> ptr() as function takes ptr & length sql/sql_select.cc: alias is now a String sql/sql_show.cc: alias is now a String sql/sql_string.h: Added move() function to change who owns the string (owner does the free) sql/sql_table.cc: alias is now a String c_ptr() -> c_ptr_safe() to avoid warnings from valgrind. sql/sql_test.cc: c_ptr() -> c_ptr_safe() to avoid warnings from valgrind. alias is now a String sql/sql_trigger.cc: c_ptr() -> c_ptr_safe() to avoid warnings from valgrind. Use field->init() to setup pointers to alias. sql/sql_update.cc: alias is now a String sql/sql_view.cc: ptr() -> c_ptr_safe() as string is not guaranteed to be \0 terminated sql/sql_yacc.yy: r() -> c_ptr() as string is not guaranteed to be \0 terminated sql/table.cc: alias is now a String sql/table.h: alias is now a String storage/federatedx/ha_federatedx.cc: Remove extra 1 byte alloc that is automaticly done by strmake() Ensure that error message ends with \0 storage/maria/ha_maria.cc: alias is now a String storage/myisam/ha_myisam.cc: alias is now a String	15 years ago
MySQL Build Team	89b9934cdb	Backport into build-201102032246-5.1.52sp1 > ------------------------------------------------------------ > revno: 3520 > revision-id: sergey.glukhov@oracle.com-20101214093303-wmo9mqcb8rz0wv9f > parent: tor.didriksen@oracle.com-20101213161301-81lprlbune7r98dl > committer: Sergey Glukhov <sergey.glukhov@oracle.com> > branch nick: mysql-5.1-bugteam > timestamp: Tue 2010-12-14 12:33:03 +0300 > message: > Fixed following problems: > --Bug#52157 various crashes and assertions with multi-table update, stored function > --Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb > --Bug#57703 create view cause Assertion failed: 0, file .\item_subselect.cc, line 846 > --Bug#57352 valgrind warnings when creating view > --Recently discovered problem when a nested materialized derived table is used > before being populated and it leads to incorrect result > > We have several modes when we should disable subquery evaluation. > The reasons for disabling are different. It could be > uselessness of the evaluation as in case of 'CREATE VIEW' > or 'PREPARE stmt', or we should disable subquery evaluation > if tables are not locked yet as it happens in bug#54475, or > too early evaluation of subqueries can lead to wrong result > as it happened in Bug#19077. > Main problem is that if subquery items are treated as const > they are evaluated in ::fix_fields(), ::fix_length_and_dec() > of the parental items as a lot of these methods have > Item::val_...() calls inside. > We have to make subqueries non-const to prevent unnecessary > subquery evaluation. At the moment we have different methods > for this. Here is a list of these modes: > > 1. PREPARE stmt; > We use UNCACHEABLE_PREPARE flag. > It is set during parsing in sql_parse.cc, mysql_new_select() for > each SELECT_LEX object and cleared at the end of PREPARE in > sql_prepare.cc, init_stmt_after_parse(). If this flag is set > subquery becomes non-const and evaluation does not happen. > > 2. CREATE\|ALTER VIEW, SHOW CREATE VIEW, I_S tables which > process FRM files > We use LEX::view_prepare_mode field. We set it before > view preparation and check this flag in > ::fix_fields(), ::fix_length_and_dec(). > Some bugs are fixed using this approach, > some are not(Bug#57352, Bug#57703). The problem here is > that we have a lot of ::fix_fields(), ::fix_length_and_dec() > where we use Item::val_...() calls for const items. > > 3. Derived tables with subquery = wrong result(Bug19077) > The reason of this bug is too early subquery evaluation. > It was fixed by adding Item::with_subselect field > The check of this field in appropriate places prevents > const item evaluation if the item have subquery. > The fix for Bug19077 fixes only the problem with > convert_constant_item() function and does not cover > other places(::fix_fields(), ::fix_length_and_dec() again) > where subqueries could be evaluated. > > Example: > CREATE TABLE t1 (i INT, j BIGINT); > INSERT INTO t1 VALUES (1, 2), (2, 2), (3, 2); > SELECT * FROM (SELECT MIN(i) FROM t1 > WHERE j = SUBSTRING('12', (SELECT * FROM (SELECT MIN(j) FROM t1) t2))) t3; > DROP TABLE t1; > > 4. Derived tables with subquery where subquery > is evaluated before table locking(Bug#54475, Bug#52157) > > Suggested solution is following: > > -Introduce new field LEX::context_analysis_only with the following > possible flags: > #define CONTEXT_ANALYSIS_ONLY_PREPARE 1 > #define CONTEXT_ANALYSIS_ONLY_VIEW 2 > #define CONTEXT_ANALYSIS_ONLY_DERIVED 4 > -Set/clean these flags when we perform > context analysis operation > -Item_subselect::const_item() returns > result depending on LEX::context_analysis_only. > If context_analysis_only is set then we return > FALSE that means that subquery is non-const. > As all subquery types are wrapped by Item_subselect > it allow as to make subquery non-const when > it's necessary.	15 years ago
MySQL Build Team	0b054706d9	Backport into build-201102032246-5.1.52sp1 > ------------------------------------------------------------ > revno: 3520 > revision-id: sergey.glukhov@oracle.com-20101214093303-wmo9mqcb8rz0wv9f > parent: tor.didriksen@oracle.com-20101213161301-81lprlbune7r98dl > committer: Sergey Glukhov <sergey.glukhov@oracle.com> > branch nick: mysql-5.1-bugteam > timestamp: Tue 2010-12-14 12:33:03 +0300 > message: > Fixed following problems: > --Bug#52157 various crashes and assertions with multi-table update, stored function > --Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb > --Bug#57703 create view cause Assertion failed: 0, file .\item_subselect.cc, line 846 > --Bug#57352 valgrind warnings when creating view > --Recently discovered problem when a nested materialized derived table is used > before being populated and it leads to incorrect result > > We have several modes when we should disable subquery evaluation. > The reasons for disabling are different. It could be > uselessness of the evaluation as in case of 'CREATE VIEW' > or 'PREPARE stmt', or we should disable subquery evaluation > if tables are not locked yet as it happens in bug#54475, or > too early evaluation of subqueries can lead to wrong result > as it happened in Bug#19077. > Main problem is that if subquery items are treated as const > they are evaluated in ::fix_fields(), ::fix_length_and_dec() > of the parental items as a lot of these methods have > Item::val_...() calls inside. > We have to make subqueries non-const to prevent unnecessary > subquery evaluation. At the moment we have different methods > for this. Here is a list of these modes: > > 1. PREPARE stmt; > We use UNCACHEABLE_PREPARE flag. > It is set during parsing in sql_parse.cc, mysql_new_select() for > each SELECT_LEX object and cleared at the end of PREPARE in > sql_prepare.cc, init_stmt_after_parse(). If this flag is set > subquery becomes non-const and evaluation does not happen. > > 2. CREATE\|ALTER VIEW, SHOW CREATE VIEW, I_S tables which > process FRM files > We use LEX::view_prepare_mode field. We set it before > view preparation and check this flag in > ::fix_fields(), ::fix_length_and_dec(). > Some bugs are fixed using this approach, > some are not(Bug#57352, Bug#57703). The problem here is > that we have a lot of ::fix_fields(), ::fix_length_and_dec() > where we use Item::val_...() calls for const items. > > 3. Derived tables with subquery = wrong result(Bug19077) > The reason of this bug is too early subquery evaluation. > It was fixed by adding Item::with_subselect field > The check of this field in appropriate places prevents > const item evaluation if the item have subquery. > The fix for Bug19077 fixes only the problem with > convert_constant_item() function and does not cover > other places(::fix_fields(), ::fix_length_and_dec() again) > where subqueries could be evaluated. > > Example: > CREATE TABLE t1 (i INT, j BIGINT); > INSERT INTO t1 VALUES (1, 2), (2, 2), (3, 2); > SELECT * FROM (SELECT MIN(i) FROM t1 > WHERE j = SUBSTRING('12', (SELECT * FROM (SELECT MIN(j) FROM t1) t2))) t3; > DROP TABLE t1; > > 4. Derived tables with subquery where subquery > is evaluated before table locking(Bug#54475, Bug#52157) > > Suggested solution is following: > > -Introduce new field LEX::context_analysis_only with the following > possible flags: > #define CONTEXT_ANALYSIS_ONLY_PREPARE 1 > #define CONTEXT_ANALYSIS_ONLY_VIEW 2 > #define CONTEXT_ANALYSIS_ONLY_DERIVED 4 > -Set/clean these flags when we perform > context analysis operation > -Item_subselect::const_item() returns > result depending on LEX::context_analysis_only. > If context_analysis_only is set then we return > FALSE that means that subquery is non-const. > As all subquery types are wrapped by Item_subselect > it allow as to make subquery non-const when > it's necessary.	15 years ago
MySQL Build Team	3eff3ea242	Backport into build-201102032246-5.1.52sp1 > ------------------------------------------------------------ > revno: 3507.1.7 > revision-id: guilhem@mysql.com-20101122085759-53uuoyqyjkh4em2m > parent: davi.arnaut@oracle.com-20101120142951-l0f3bxmcwibcplxq > committer: Guilhem Bichot <guilhem@mysql.com> > branch nick: mysql-5.1-bugteam > timestamp: Mon 2010-11-22 09:57:59 +0100 > message: > Fix for Bug#56138 "valgrind errors about overlapping memory when double-assigning same variable", > and related small fixes.	15 years ago
MySQL Build Team	e92dff848f	Backport into build-201102032246-5.1.52sp1 > ------------------------------------------------------------ > revno: 3507.1.7 > revision-id: guilhem@mysql.com-20101122085759-53uuoyqyjkh4em2m > parent: davi.arnaut@oracle.com-20101120142951-l0f3bxmcwibcplxq > committer: Guilhem Bichot <guilhem@mysql.com> > branch nick: mysql-5.1-bugteam > timestamp: Mon 2010-11-22 09:57:59 +0100 > message: > Fix for Bug#56138 "valgrind errors about overlapping memory when double-assigning same variable", > and related small fixes.	15 years ago
Tor Didriksen	175e89260e	Bug #59498 div function broken in mysql-trunk mysql-test/r/func_math.result: New test case. mysql-test/t/func_math.test: New test case. sql/item_func.cc: Check for null before converting value to my_decimal.	15 years ago
Tor Didriksen	02d7b27641	Bug #59498 div function broken in mysql-trunk	15 years ago
Tor Didriksen	7bf234032a	Bug #59241 invalid memory read in do_div_mod with doubly assigned variables Fix: copy my_decimal by value, to avoid dangling pointers. mysql-test/r/func_math.result: New test case. mysql-test/t/func_math.test: New test case. sql/item_cmpfunc.cc: No need to call fix_buffer_pointer() anymore. sql/item_func.cc: Copy my_decimal by value, to avoid dangling pointers. sql/my_decimal.h: Implement proper copy constructor and assignment operator for my_decimal. sql/sql_analyse.cc: No need to call fix_buffer_pointer() anymore. strings/decimal.c: Remove #line directive: it messes up TAGS and it confuses gdb when debugging.	15 years ago
Tor Didriksen	8dfab82ee0	Bug #59241 invalid memory read in do_div_mod with doubly assigned variables Fix: copy my_decimal by value, to avoid dangling pointers.	15 years ago
Kent Boortz	85323eda8a	- Added/updated copyright headers - Removed files specific to compiling on OS/2 - Removed files specific to SCO Unix packaging - Removed "libmysqld/copyright", text is included in documentation - Removed LaTeX headers for NDB Doxygen documentation - Removed obsolete NDB files - Removed "mkisofs" binaries - Removed the "cvs2cl.pl" script - Changed a few GPL texts to use "program" instead of "library"	15 years ago
Kent Boortz	fddb1f1b13	- Added/updated copyright headers - Removed files specific to compiling on OS/2 - Removed files specific to SCO Unix packaging - Removed "libmysqld/copyright", text is included in documentation - Removed LaTeX headers for NDB Doxygen documentation - Removed obsolete NDB files - Removed "mkisofs" binaries - Removed the "cvs2cl.pl" script - Changed a few GPL texts to use "program" instead of "library"	15 years ago
Igor Babaev	efbb3c6c90	Fixed LP bug #639935 (bug #58727 ). When the optimizer creates items out of other items it does not have to call the fix_fields method. Usually in these cases it calls quick_fix_field() that just marks the created item as fixed. If the created item is an Item_func object then calling quick_fix_field() works fine if the arguments of the created functional item are already fixed. Otherwise some unfixed nodes remain in the item tree and it triggers an assertion failure whenever the item is evaluated. Fixed the problem by making the method quick_fix_field virtual and providing an implementation for the class Item_func objects that recursively calls the method for unfixed arguments of any functional item.	15 years ago
Sergey Glukhov	bc56dcea9d	Bug#57810 case/when/then : Assertion failed: length \|\| !scale ASSERT happens due to improper calculation of the max_length in Item_func_div object, if dividend has max_length == 0 then Item_func_div::max_length is set to 0 under some circumstances. The fix: If decimals == NOT_FIXED_DEC then set Item_func_div::max_length to max possible DOUBLE length value. mysql-test/r/func_math.result: test case mysql-test/t/func_math.test: test case sql/item_func.cc: The fix: If decimals == NOT_FIXED_DEC then set Item_func_div::max_length to max possible DOUBLE length value.	15 years ago
Sergey Glukhov	b69b46c775	Bug#57810 case/when/then : Assertion failed: length \|\| !scale ASSERT happens due to improper calculation of the max_length in Item_func_div object, if dividend has max_length == 0 then Item_func_div::max_length is set to 0 under some circumstances. The fix: If decimals == NOT_FIXED_DEC then set Item_func_div::max_length to max possible DOUBLE length value.	15 years ago
Sergey Glukhov	fcb83cbf15	Fixed following problems: --Bug#52157 various crashes and assertions with multi-table update, stored function --Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb --Bug#57703 create view cause Assertion failed: 0, file .\item_subselect.cc, line 846 --Bug#57352 valgrind warnings when creating view --Recently discovered problem when a nested materialized derived table is used before being populated and it leads to incorrect result We have several modes when we should disable subquery evaluation. The reasons for disabling are different. It could be uselessness of the evaluation as in case of 'CREATE VIEW' or 'PREPARE stmt', or we should disable subquery evaluation if tables are not locked yet as it happens in bug#54475, or too early evaluation of subqueries can lead to wrong result as it happened in Bug#19077. Main problem is that if subquery items are treated as const they are evaluated in ::fix_fields(), ::fix_length_and_dec() of the parental items as a lot of these methods have Item::val_...() calls inside. We have to make subqueries non-const to prevent unnecessary subquery evaluation. At the moment we have different methods for this. Here is a list of these modes: 1. PREPARE stmt; We use UNCACHEABLE_PREPARE flag. It is set during parsing in sql_parse.cc, mysql_new_select() for each SELECT_LEX object and cleared at the end of PREPARE in sql_prepare.cc, init_stmt_after_parse(). If this flag is set subquery becomes non-const and evaluation does not happen. 2. CREATE\|ALTER VIEW, SHOW CREATE VIEW, I_S tables which process FRM files We use LEX::view_prepare_mode field. We set it before view preparation and check this flag in ::fix_fields(), ::fix_length_and_dec(). Some bugs are fixed using this approach, some are not(Bug#57352, Bug#57703). The problem here is that we have a lot of ::fix_fields(), ::fix_length_and_dec() where we use Item::val_...() calls for const items. 3. Derived tables with subquery = wrong result(Bug19077) The reason of this bug is too early subquery evaluation. It was fixed by adding Item::with_subselect field The check of this field in appropriate places prevents const item evaluation if the item have subquery. The fix for Bug19077 fixes only the problem with convert_constant_item() function and does not cover other places(::fix_fields(), ::fix_length_and_dec() again) where subqueries could be evaluated. Example: CREATE TABLE t1 (i INT, j BIGINT); INSERT INTO t1 VALUES (1, 2), (2, 2), (3, 2); SELECT * FROM (SELECT MIN(i) FROM t1 WHERE j = SUBSTRING('12', (SELECT * FROM (SELECT MIN(j) FROM t1) t2))) t3; DROP TABLE t1; 4. Derived tables with subquery where subquery is evaluated before table locking(Bug#54475, Bug#52157) Suggested solution is following: -Introduce new field LEX::context_analysis_only with the following possible flags: #define CONTEXT_ANALYSIS_ONLY_PREPARE 1 #define CONTEXT_ANALYSIS_ONLY_VIEW 2 #define CONTEXT_ANALYSIS_ONLY_DERIVED 4 -Set/clean these flags when we perform context analysis operation -Item_subselect::const_item() returns result depending on LEX::context_analysis_only. If context_analysis_only is set then we return FALSE that means that subquery is non-const. As all subquery types are wrapped by Item_subselect it allow as to make subquery non-const when it's necessary. mysql-test/r/derived.result: test case mysql-test/r/multi_update.result: test case mysql-test/r/view.result: test case mysql-test/suite/innodb/r/innodb_multi_update.result: test case mysql-test/suite/innodb/t/innodb_multi_update.test: test case mysql-test/suite/innodb_plugin/r/innodb_multi_update.result: test case mysql-test/suite/innodb_plugin/t/innodb_multi_update.test: test case mysql-test/t/derived.test: test case mysql-test/t/multi_update.test: test case mysql-test/t/view.test: test case sql/item.cc: --removed unnecessary code sql/item_cmpfunc.cc: --removed unnecessary checks --THD::is_context_analysis_only() is replaced with LEX::is_ps_or_view_context_analysis() sql/item_func.cc: --refactored context analysis checks sql/item_row.cc: --removed unnecessary checks sql/item_subselect.cc: --removed unnecessary code --added DBUG_ASSERT into Item_subselect::exec() which asserts that subquery execution can not happen if LEX::context_analysis_only is set, i.e. at context analysis stage. --Item_subselect::const_item() Return FALSE if LEX::context_analysis_only is set. It prevents subquery evaluation in ::fix_fields & ::fix_length_and_dec at context analysis stage. sql/item_subselect.h: --removed unnecessary code sql/mysql_priv.h: --Added new set of flags. sql/sql_class.h: --removed unnecessary code sql/sql_derived.cc: --added LEX::context_analysis_only analysis intialization/cleanup sql/sql_lex.cc: --init LEX::context_analysis_only field sql/sql_lex.h: --New LEX::context_analysis_only field sql/sql_parse.cc: --removed unnecessary code sql/sql_prepare.cc: --removed unnecessary code --added LEX::context_analysis_only analysis intialization/cleanup sql/sql_select.cc: --refactored context analysis checks sql/sql_show.cc: --added LEX::context_analysis_only analysis intialization/cleanup sql/sql_view.cc: --added LEX::context_analysis_only analysis intialization/cleanup	15 years ago
Sergey Glukhov	cd36a6a5d5	Fixed following problems: --Bug#52157 various crashes and assertions with multi-table update, stored function --Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb --Bug#57703 create view cause Assertion failed: 0, file .\item_subselect.cc, line 846 --Bug#57352 valgrind warnings when creating view --Recently discovered problem when a nested materialized derived table is used before being populated and it leads to incorrect result We have several modes when we should disable subquery evaluation. The reasons for disabling are different. It could be uselessness of the evaluation as in case of 'CREATE VIEW' or 'PREPARE stmt', or we should disable subquery evaluation if tables are not locked yet as it happens in bug#54475, or too early evaluation of subqueries can lead to wrong result as it happened in Bug#19077. Main problem is that if subquery items are treated as const they are evaluated in ::fix_fields(), ::fix_length_and_dec() of the parental items as a lot of these methods have Item::val_...() calls inside. We have to make subqueries non-const to prevent unnecessary subquery evaluation. At the moment we have different methods for this. Here is a list of these modes: 1. PREPARE stmt; We use UNCACHEABLE_PREPARE flag. It is set during parsing in sql_parse.cc, mysql_new_select() for each SELECT_LEX object and cleared at the end of PREPARE in sql_prepare.cc, init_stmt_after_parse(). If this flag is set subquery becomes non-const and evaluation does not happen. 2. CREATE\|ALTER VIEW, SHOW CREATE VIEW, I_S tables which process FRM files We use LEX::view_prepare_mode field. We set it before view preparation and check this flag in ::fix_fields(), ::fix_length_and_dec(). Some bugs are fixed using this approach, some are not(Bug#57352, Bug#57703). The problem here is that we have a lot of ::fix_fields(), ::fix_length_and_dec() where we use Item::val_...() calls for const items. 3. Derived tables with subquery = wrong result(Bug19077) The reason of this bug is too early subquery evaluation. It was fixed by adding Item::with_subselect field The check of this field in appropriate places prevents const item evaluation if the item have subquery. The fix for Bug19077 fixes only the problem with convert_constant_item() function and does not cover other places(::fix_fields(), ::fix_length_and_dec() again) where subqueries could be evaluated. Example: CREATE TABLE t1 (i INT, j BIGINT); INSERT INTO t1 VALUES (1, 2), (2, 2), (3, 2); SELECT * FROM (SELECT MIN(i) FROM t1 WHERE j = SUBSTRING('12', (SELECT * FROM (SELECT MIN(j) FROM t1) t2))) t3; DROP TABLE t1; 4. Derived tables with subquery where subquery is evaluated before table locking(Bug#54475, Bug#52157) Suggested solution is following: -Introduce new field LEX::context_analysis_only with the following possible flags: #define CONTEXT_ANALYSIS_ONLY_PREPARE 1 #define CONTEXT_ANALYSIS_ONLY_VIEW 2 #define CONTEXT_ANALYSIS_ONLY_DERIVED 4 -Set/clean these flags when we perform context analysis operation -Item_subselect::const_item() returns result depending on LEX::context_analysis_only. If context_analysis_only is set then we return FALSE that means that subquery is non-const. As all subquery types are wrapped by Item_subselect it allow as to make subquery non-const when it's necessary.	15 years ago
Georgi Kodinov	3190d45423	Backport of the 5.1 fix for bug #55826 to 5.0	15 years ago
Georgi Kodinov	7e8ddb6b03	Backport of the 5.1 fix for bug #55826 to 5.0	15 years ago
Gleb Shchepa	e5a88caf08	Bug #57187 : more user variable fun with multiple assignments and comparison in query A query that compares assignments of the same user variable caused Valgrind warnings: access to freed memory region. In case of a DECIMAL argument the assignment operator (:=) may return a pointer to a stored value instead of its copy when evaluated. The next assignment to the same variable may: a) overwrite the stored value with a new one and return the same pointer or even b) reallocate stored value. Thus, if we evaluate an assignment and keep the result pointer and then evaluate another assignment to the same variable, then the kept result pointer of the first assignment will point to unexpectedly changed data or it may be a dead pointer. That may cause wrong data or crash. The user_var_entry::val_decimal method has been modified to copy user variable data. mysql-test/r/user_var.result: Test case for bug #57187. mysql-test/t/user_var.test: Test case for bug #57187. sql/item_func.cc: Bug #57187: more user variable fun with multiple assignments and comparison in query The user_var_entry::val_decimal method has been modified to copy user variable data.	15 years ago
Gleb Shchepa	a44b544498	Bug #57187 : more user variable fun with multiple assignments and comparison in query A query that compares assignments of the same user variable caused Valgrind warnings: access to freed memory region. In case of a DECIMAL argument the assignment operator (:=) may return a pointer to a stored value instead of its copy when evaluated. The next assignment to the same variable may: a) overwrite the stored value with a new one and return the same pointer or even b) reallocate stored value. Thus, if we evaluate an assignment and keep the result pointer and then evaluate another assignment to the same variable, then the kept result pointer of the first assignment will point to unexpectedly changed data or it may be a dead pointer. That may cause wrong data or crash. The user_var_entry::val_decimal method has been modified to copy user variable data.	15 years ago
Georgi Kodinov	a4b106c882	Backport of bug #55564 to 5.0-security	15 years ago
Georgi Kodinov	5df7f9bc26	Backport of bug #55564 to 5.0-security	15 years ago
Michael Widenius	ab5e4eefd5	Fixed some compiler warnings found when compiling for windows. Changed rows_read and rows_sent status variables to be longlong (to avoid compiler warnings) sql/item_func.cc: Fixed wrong usage of alias sql/item_subselect.cc: Changed buffer size to ulonglong to be able detect buffers bigger than size_t sql/item_subselect.h: Changed buffer size to ulonglong to be able detect buffers bigger than size_t sql/multi_range_read.cc: Fixed compiler warning by using correct type for function argument sql/mysqld.cc: Changed rows_read and rows_sent status variables to be longlong sql/opt_subselect.h: Fixed compiler warning by using correct type for function argument sql/sql_class.cc: Changed rows_read and rows_sent status variables to be longlong sql/sql_class.h: Changed rows_read and rows_sent status variables to be longlong Changed max_nulls_in_row to uint as this is number of columns in row. This fixed some compiler warnings. sql/sql_select.cc: Added casts to avoid compiler warnings storage/heap/ha_heap.cc: Initilize different types separate storage/oqgraph/ha_oqgraph.cc: Fixed argument to store(longlong) to avoid compiler warnings	15 years ago
Michael Widenius	7c56b08216	Added TRASH() to table->record[0] to find out if we access not initialzed data. - Changed Cached_item_field not copy data for fields with NULL value - In key_copy() and key_restore() don't copy data for fields with NULL value Fixed code to avoid valgrind warnings - Use c_ptr_safe instead of c_ptr() Removed "QQ" from comments (QQ was ment to be used for internal comments that should be removed before pushing) Fixed wrong alias used (from previous patch) sql/event_db_repository.cc: Update testing if event table is valid (to avoid valgrind errors) sql/ha_partition.cc: m_ordered_scan_ongoing was not initialized Reset null bits in record to avoid valgrind errors sql/handler.h: Added flag if storage engine will write row verbatim and the row contains varchar or null fields (in which case we must clear the row to avoid valgrind warnings) sql/item_buff.cc: Changed Cached_item_field not copy data for fields with NULL value (Optimization and avoids valgrind warnings) sql/item_func.cc: c_ptr() -> c_ptr_safe() sql/key.cc: In key_copy() and key_restore() don't copy data for fields with NULL value sql/opt_range.cc: c_ptr() -> c_ptr_safe() sql/sql_base.cc: Added TRASH() to table->record[0] to find out if we access not initialzed data. Initialize null_bytes to: - Get consistent tests - Ensure we don't get valgrind warnings for null fields (as we may only update a couple of bits in a byte) sql/sql_class.cc: Removed "QQ" from comments sql/sql_insert.cc: Initialize row to default values if we are using valgrind and row will be copied verbatim to disk in storage engine. sql/sql_load.cc: QQ -> TODO sql/sql_parse.cc: Removed old not used code marked QQ and withing "#ifdef REMOVED" sql/sql_select.cc: QQ -> TODO Initialize some variables that was used uninitialized Added DBUG_ASSERT() to find out if thd was not properly initialized for sub queries sql/sql_test.cc: Fixed format for printing to DBUG file Fixed wrong alias used (from previous patch) sql/sql_trigger.h: QQ -> TODO sql/table.cc: QQ -> TODO storage/maria/ha_maria.cc: Mark table with HA_RECORD_MUST_BE_CLEAN_ON_WRITE, if row is written verbatim to disk and contains varchar or null fields. storage/maria/ma_open.c: Added flags if table has varchar or null fields storage/maria/maria_def.h: Added flags if table has varchar or null fields storage/myisam/ha_myisam.cc: Mark table with HA_RECORD_MUST_BE_CLEAN_ON_WRITE, if row is written verbatim to disk and contains varchar or null fields. storage/myisam/mi_open.c: Fixed memory overrun bug when using fulltext keys storage/xtradb/row/row0sel.c: Removed initialization of null bits. (not needed anymore)	15 years ago
Gleb Shchepa	a30e9dda78	backport of bug #54461 from 5.1-security to 5.0-security > revision-id: gshchepa@mysql.com-20100801181236-uyuq6ewaq43rw780 > parent: alexey.kopytov@sun.com-20100723115254-jjwmhq97b9wl932l > committer: Gleb Shchepa <gshchepa@mysql.com> > branch nick: mysql-5.1-security > timestamp: Sun 2010-08-01 22:12:36 +0400 > Bug #54461: crash with longblob and union or update with subquery > > Queries may crash, if > 1) the GREATEST or the LEAST function has a mixed list of > numeric and LONGBLOB arguments and > 2) the result of such a function goes through an intermediate > temporary table. > > An Item that references a LONGBLOB field has max_length of > UINT_MAX32 == (2^32 - 1). > > The current implementation of GREATEST/LEAST returns REAL > result for a mixed list of numeric and string arguments (that > contradicts with the current documentation, this contradiction > was discussed and it was decided to update the documentation). > > The max_length of such a function call was calculated as a > maximum of argument max_length values (i.e. UINT_MAX32). > > That max_length value of UINT_MAX32 was used as a length for > the intermediate temporary table Field_double to hold > GREATEST/LEAST function result. > > The Field_double::val_str() method call on that field > allocates a String value. > > Since an allocation of String reserves an additional byte > for a zero-termination, the size of String buffer was > set to (UINT_MAX32 + 1), that caused an integer overflow: > actually, an empty buffer of size 0 was allocated. > > An initialization of the "first" byte of that zero-size > buffer with '\0' caused a crash. > > The Item_func_min_max::fix_length_and_dec() has been > modified to calculate max_length for the REAL result like > we do it for arithmetical operators. mysql-test/r/func_misc.result: Test case for bug #54461. mysql-test/t/func_misc.test: Test case for bug #54461. sql/item_func.cc: Bug #54461: crash with longblob and union or update with subquery The Item_func_min_max::fix_length_and_dec() has been modified to calculate max_length for the REAL result like we do it for arithmetical operators.	15 years ago
Gleb Shchepa	d85c305362	backport of bug #54461 from 5.1-security to 5.0-security > revision-id: gshchepa@mysql.com-20100801181236-uyuq6ewaq43rw780 > parent: alexey.kopytov@sun.com-20100723115254-jjwmhq97b9wl932l > committer: Gleb Shchepa <gshchepa@mysql.com> > branch nick: mysql-5.1-security > timestamp: Sun 2010-08-01 22:12:36 +0400 > Bug #54461: crash with longblob and union or update with subquery > > Queries may crash, if > 1) the GREATEST or the LEAST function has a mixed list of > numeric and LONGBLOB arguments and > 2) the result of such a function goes through an intermediate > temporary table. > > An Item that references a LONGBLOB field has max_length of > UINT_MAX32 == (2^32 - 1). > > The current implementation of GREATEST/LEAST returns REAL > result for a mixed list of numeric and string arguments (that > contradicts with the current documentation, this contradiction > was discussed and it was decided to update the documentation). > > The max_length of such a function call was calculated as a > maximum of argument max_length values (i.e. UINT_MAX32). > > That max_length value of UINT_MAX32 was used as a length for > the intermediate temporary table Field_double to hold > GREATEST/LEAST function result. > > The Field_double::val_str() method call on that field > allocates a String value. > > Since an allocation of String reserves an additional byte > for a zero-termination, the size of String buffer was > set to (UINT_MAX32 + 1), that caused an integer overflow: > actually, an empty buffer of size 0 was allocated. > > An initialization of the "first" byte of that zero-size > buffer with '\0' caused a crash. > > The Item_func_min_max::fix_length_and_dec() has been > modified to calculate max_length for the REAL result like > we do it for arithmetical operators.	15 years ago
Michael Widenius	52090a4434	Code cleanup to get fewer reallocs() during execution. - Changed TABLE->alias to String to get fewer reallocs when alias are used. - Preallocate some buffers Changed some String->c_ptr() -> String->ptr() when \0 is not needed. Fixed wrong usage of String->ptr() when we need a \0 terminated string. Use my_strtod() instead of my_atof() to avoid having to add \0 to string. c_ptr() -> c_ptr_safe() to avoid warnings from valgrind. zr sql/event_db_repository.cc: Update usage of TABLE->alias sql/event_scheduler.cc: c_ptr() -> c_ptr_safe() sql/events.cc: c_ptr() -> ptr() as \0 was not needed sql/field.cc: Update usage of TABLE->alias sql/field.h: Update usage of TABLE->alias sql/ha_partition.cc: Update usage of TABLE->alias sql/handler.cc: Update usage of TABLE->alias Fixed wrong usage of str.ptr() sql/item.cc: Fixed error where code wrongly assumed string was \0 terminated. sql/item_func.cc: c_ptr() -> c_ptr_safe() Update usage of TABLE->alias sql/item_sum.h: Use my_strtod() instead of my_atof() to avoid having to add \0 to string sql/lock.cc: Update usage of TABLE->alias sql/log.cc: c_ptr() -> ptr() as \0 was not needed sql/log_event.cc: c_ptr_quick() -> ptr() as \0 was not needed sql/opt_range.cc: ptr() -> c_ptr() as \0 is needed sql/opt_subselect.cc: Update usage of TABLE->alias sql/opt_table_elimination.cc: Update usage of TABLE->alias sql/set_var.cc: ptr() -> c_ptr() as \0 is needed c_ptr() -> c_ptr_safe() sql/sp.cc: c_ptr() -> ptr() as \0 was not needed sql/sp_rcontext.cc: Update usage of TABLE->alias sql/sql_base.cc: Preallocate buffers Update usage of TABLE->alias sql/sql_class.cc: Fix arguments to sprintf() to work even if string is not \0 terminated sql/sql_insert.cc: Update usage of TABLE->alias c_ptr() -> ptr() as \0 was not needed sql/sql_load.cc: Preallocate buffers Trivial optimizations sql/sql_parse.cc: Trivial optimization sql/sql_plugin.cc: c_ptr() -> ptr() as \0 was not needed sql/sql_select.cc: Update usage of TABLE->alias sql/sql_show.cc: Update usage of TABLE->alias sql/sql_string.h: Added move() function to move allocated memory from one object to another. sql/sql_table.cc: Update usage of TABLE->alias c_ptr() -> c_ptr_safe() sql/sql_test.cc: ptr() -> c_ptr_safe() sql/sql_trigger.cc: Update usage of TABLE->alias c_ptr() -> c_ptr_safe() sql/sql_update.cc: Update usage of TABLE->alias sql/sql_view.cc: ptr() -> c_ptr_safe() sql/sql_yacc.yy: ptr() -> c_ptr() sql/table.cc: Update usage of TABLE->alias sql/table.h: Changed TABLE->alias to String to get fewer reallocs when alias are used. storage/federatedx/ha_federatedx.cc: Use c_ptr_safe() to ensure strings are \0 terminated. storage/maria/ha_maria.cc: Update usage of TABLE->alias storage/myisam/ha_myisam.cc: Update usage of TABLE->alias storage/xtradb/row/row0sel.c: Ensure that null bits in record are properly reset. (Old code didn't work as row_search_for_mysql() can be called twice while reading fields from one row.	15 years ago
Guilhem Bichot	96b0404940	Fix for Bug#56138 "valgrind errors about overlapping memory when double-assigning same variable", and related small fixes. mysql-test/t/user_var.test: test for bug sql/field_conv.cc: From the C standard, memcpy() has undefined behaviour if to->ptr==from->ptr sql/item_func.cc: In the case of BUG#56138, entry->value==ptr in which case memcpy() has undefined results per the C standard. sql/sql_select.cc: Work around a bug in old gcc	15 years ago
Guilhem Bichot	b5586c67ec	Fix for Bug#56138 "valgrind errors about overlapping memory when double-assigning same variable", and related small fixes.	15 years ago
unknown	0de9a4abab	MWL#74: Shared libmysqld.so library. Switch makefiles to use libtool to build libmysqld.so, as well as all its dependencies. The previous MYSQL_PLUGIN_DEPENDS_ON_MYSQL_INTERNALS() declaration is removed, as it does not work well with a libtool build. Instead, plugins that need it can specify an alternate object in MYSQL_PLUGIN_STATIC() that will be used for embedded library. The plugin must then take care itself of compiling the special object for embedded, rebuilding the source files previously listed in MYSQL_PLUGIN_DEPENDS_ON_MYSQL_INTERNALS() with @plugin_embedded_defs@ in CFLAGS/CXXFLAGS. The extra target @XXX_embedded_static_target@ is available for the special object, this will be empty when --without-embedded-server. All in-tree plugins are changed to build their static targets with libtool. Additional plugins that want to work with libmysqld.so will need to be similarly modified to build with libtool (or otherwise provide an -fPIC object). Dynamically loaded plugins are not affected. The old libraries like libmysys.a, libmyisam.a and similar libraries, which were installed by `make install` though this is of little use, are still built and installed to not break package scripts etc. that expect them. These libraries are kept static to avoid introducing new .so dependencies. The patch also fixes a handfull of duplicate symbol linker errors, where we included some object twice during linking; these for one reason or another did not produce errors before but caused problems on some platforms with this patch (eg. Mac OS X linker is more strict for shared objects). This patch only does what is necessary to build libmysqld.so. There are some more cleanups that are possible now that we are using libtool more fully, which could done in subsequent patches (though we may not bother as we are switching from autotools to CMake anyway): - In libmysql_r/, we should be able to just link libmysys.la etc, instead of symlinking and re-compiling sources into the directory. - In libmysql/, we can similarly avoid symlinking and recompiling sources if we instead build a libmysys_nothread.la library with appropriate CFLAGS and link that. - In sql/, we can build a separate target libmysql_int.la with appropriate CFLAGS for embedded and use that in libmysqld/ instead of symlinking sources. - libmysys.a, libmyisam.a and similar libraries could be installed as .so also to save on code size; or alternatively could be not installed at all. client/Makefile.am: Updated for using libtool config/ac-macros/plugins.m4: Replace MUSQL_PLUGIN_DEPENDS_ON_MYSQL_INTERNALS with mechanism for plugins to specify alternate object for embedded. configure.in: Fix linking duplicate objects related to THREAD_LOBJECTS. dbug/Makefile.am: Updated for using libtool extra/Makefile.am: Fix relative paths. libmysqld/Makefile.am: Build libmysqld.la using libtool libmysqld/examples/Makefile.am: Updated to use libtool mysys/Makefile.am: Updated to use libtool. Fix linking duplicate objects related to THREAD_LOBJECTS. mysys/my_uuid.c: Fix conflicting global mutex name by making it static. regex/Makefile.am: Updated to use libtool sql/Makefile.am: Updated to use libtool sql/item_func.cc: Fix conflicting mutex name. sql/mysql_priv.h: Fix conflicting mutex name sql/mysqld.cc: Fix conflicting mutex name. Add missing call of my_uuid_end(). storage/archive/Makefile.am: Updated to use libtool storage/archive/plug.in: Updated to use libtool storage/blackhole/Makefile.am: Updated to use libtool storage/blackhole/plug.in: Updated to use libtool storage/csv/Makefile.am: Updated to use libtool storage/csv/plug.in: Updated to use libtool storage/example/Makefile.am: Updated to use libtool storage/federated/Makefile.am: Updated to use libtool storage/federated/plug.in: Updated to use libtool storage/federatedx/Makefile.am: Updated to use libtool storage/federatedx/plug.in: Updated to use libtool storage/heap/Makefile.am: Updated to use libtool storage/heap/plug.in: Updated to use libtool storage/innobase/Makefile.am: Updated to use libtool storage/innobase/plug.in.disabled: Updated to use libtool storage/innodb_plugin/Makefile.am: Updated to use libtool storage/maria/CMakeLists.txt: Fix linking duplicate object in maria_dump_log, causes failure on Mac OS X storage/maria/Makefile.am: Updated to use libtool Fix linking duplicate object in maria_dump_log, causes link failure on Mac OS X storage/maria/ma_loghandler.c: Move maria_dump_log code to separate file to fix duplicate object link failures. storage/maria/ma_loghandler.h: Move maria_dump_log code to separate file to fix duplicate object link failures. storage/maria/maria_dump_log.c: Move maria_dump_log code to separate file to fix duplicate object link failures. storage/maria/plug.in: Updated to use libtool storage/myisam/Makefile.am: Updated to use libtool storage/myisam/plug.in: Updated to use libtool storage/myisammrg/Makefile.am: Updated to use libtool storage/myisammrg/plug.in: Updated to use libtool storage/pbxt/plug.in: Updated to use libtool storage/pbxt/src/Makefile.am: Updated to use libtool storage/xtradb/Makefile.am: Updated to use libtool storage/xtradb/plug.in: Updated to use libtool strings/Makefile.am: Updated to use libtool unittest/unit.pl: Don't attempt to run libtool internal files as unit tests. vio/Makefile.am: Updated to use libtool	15 years ago
Tatiana A. Nurnberg	c4fa6a3862	Bug#43233: Some server variables are clipped during "update," not "check" stage Bug#55794: ulonglong options of mysqld show wrong values. Port the few remaining system variables to the correct mechanism -- range-check in check-stage (and throw error or warning at that point as needed and depending on STRICTness), update in update stage. Fix some signedness errors when retrieving sysvar values for display. mysql-test/r/variables.result: Show that we throw warnings or errors depending on strictness even for "special" variables now. mysql-test/t/variables.test: Show that we throw warnings or errors depending on strictness even for "special" variables now. sql/item_func.cc: show sys_var_ulonglong_ptr and SHOW_LONGLONG type variables as unsigned. sql/set_var.cc: move range-checking from update stage to check stage for the remaining few sys-vars that broke the pattern sql/set_var.h: add check functions.	15 years ago
Tatiana A. Nurnberg	58f5b9c0cc	Bug#43233: Some server variables are clipped during "update," not "check" stage Bug#55794: ulonglong options of mysqld show wrong values. Port the few remaining system variables to the correct mechanism -- range-check in check-stage (and throw error or warning at that point as needed and depending on STRICTness), update in update stage. Fix some signedness errors when retrieving sysvar values for display.	15 years ago

... 2 3 4 5 6 ...

3030 Commits (3b0c7ac1f9d64afc933ce0354037c709366b7dff)