mariadb

Commit Graph

Author	SHA1	Message	Date
Ole John Aske	221ce9223d	Fix for bug#59308: Incorrect result for SELECT DISTINCT <col>... ORDER BY <col> DESC. Also fix bug#59110: Memory leak of QUICK_SELECT_I allocated memory. Includes Jørgen Lølands review comments. Root cause of these bugs are that test_if_skip_sort_order() decided to revert the 'skip_sort_order' descision (and use filesort) after the query plan has been updated to reflect a 'skip' of the sort order. This might happen in 'check_reverse_order:' if we have a select->quick which could not be made descending by appending a QUICK_SELECT_DESC. (). The original 'save_quick' was then restored after the QEP has been modified, which caused: - An incorrect 'precomputed_group_by= TRUE' may have been set, and not reverted, as part of the already modifified QEP (Bug#59308) - A 'select->quick' might have been created which we fail to delete (bug#59110). This fix is a refactorication of test_if_skip_sort_order() where all logic related to modification of QEP (controlled by argument 'bool no_changes'), is moved to the end of test_if_skip_sort_order(), and done after all 'test_if_skip' checks has been performed - including the 'check_reverse_order:' checks. The refactorication above contains now intentional changes to the logic which has been moved to the end of the function. Furthermore, a smaller part of the fix address the handling of the select->quick objects which may already exists when we call 'test_if_skip_sort_order()' (save_quick) -and new select->quick's created during test_if_skip_sort_order(): - Before new select->quick may be created by calling ::test_quick_select(), we set 'select->quick= 0' to avoid that ::test_quick_select() prematurely delete the save_quick's. (After this call we may have both a 'save_quick' and 'select->quick') - All returns from ::test_if_skip_sort_order() where we may have both a 'save_quick' and a 'select->quick' has been changed to goto's to the exit points 'skiped_sort_order:' or 'need_filesort:' where we decide which of the QUICK_SELECT's to keep, and delete the other.	15 years ago
Dmitry Shulga	378091e434	Fixed bug#58026 - massive recursion and crash in regular expression handling. The problem was that parsing of nested regular expression involved recursive calls. Such recursion didn't take into account the amount of available stack space, which ended up leading to stack overflow crashes. mysql-test/t/not_embedded_server.test: Added test for bug#58026. regex/my_regex.h: added pointer to function as last argument of my_regex_init() for check enough memory in stack. regex/regcomp.c: p_ere() was modified: added call to function for check enough memory in stack. Function for check available stack space specified by global variable my_regex_enough_mem_in_stack. This variable set to NULL for embedded mysqld and to a pointer to function check_enough_stack_size otherwise. regex/reginit.c: my_regex_init was modified: pass a pointer to a function for check enough memory in stack space. Reset this pointer to NULL in my_regex_end. sql/mysqld.cc: Added function check_enough_stack_size() for check enough memory in stack. Passed this function as second argument to my_regex_init. For embedded mysqld passed NULL as second argument.	15 years ago
Georgi Kodinov	a70c34bf0f	Fixes for Bug #55755 and Bug #52315 part 2 Bug #55755 : Date STD variable signness breaks server on FreeBSD and OpenBSD * Added a check to configure on the size of time_t * Created a macro to check for a valid time_t that is safe to use with datetime functions and store in TIMESTAMP columns. * Used the macro consistently instead of the ad-hoc checks introduced by 52315 * Fixed compliation warnings on platforms where the size of time_t is smaller than the size of a long (e.g. OpenBSD 4.8 64 amd64). Bug #52315: utc_date() crashes when system time > year 2037 * Added a correct check for the timestamp range instead of just variable size check to SET TIMESTAMP. * Added overflow checking before converting to time_t. * Using a correct localized error message in this case instead of the generic error. * Added a test suite. * fixed the checks so that they check for unsigned time_t as well. Used the checks consistently across the source code. * fixed the original test case to expect the new error code.	15 years ago
Dmitry Lenev	e805a0fd9d	Fix for bug #58650 "Failing assertion: primary_key_no == -1 \|\| primary_key_no == 0". Attempt to create InnoDB table with non-nullable column of geometry type having an unique key with length 12 on it and with some other candidate key led to server crash due to assertion failure in both non-debug and debug builds. The problem was that such a non-candidate key could have been sorted as the first key in table/.FRM, before any legit candidate keys. This resulted in assertion failure in InnoDB engine which assumes that primary key should either be the first key in table/.FRM or should not exist at all. The reason behind such an incorrect sorting was an wrong value of Create_field::key_length member for geometry field (which was set to its pack_length == 12) which confused code in mysql_prepare_create_table(), so it would skip marking such key as a key with partial segments. This patch fixes the problem by ensuring that this member gets the same value of Create_field::key_length member as for other blob fields (from which geometry field class is inherited), and as result unique keys on geometry fields are correctly marked as having partial segments. mysql-test/include/gis_keys.inc: Added test case for bug #58650 "Failing assertion: primary_key_no == -1 \|\| primary_key_no == 0". mysql-test/r/gis.result: Added test case for bug #58650 "Failing assertion: primary_key_no == -1 \|\| primary_key_no == 0". mysql-test/suite/innodb/r/innodb_gis.result: Added test case for bug #58650 "Failing assertion: primary_key_no == -1 \|\| primary_key_no == 0". mysql-test/suite/innodb_plugin/r/innodb_gis.result: Added test case for bug #58650 "Failing assertion: primary_key_no == -1 \|\| primary_key_no == 0". sql/field.cc: Changed Create_field::create_length_to_internal_length() to correctly set Create_field::key_length member for geometry fields. Similar to the blob types key_length for such fields should be the same as length and not field's packed length (which is always 12 for geometry). As result of this change code handling table creation now always correctly identifies btree/unique keys on geometry fields as partial keys, so such keys can't be erroneously treated as candidate keys and sorted in keys array in .FRM before legit candidate keys. This fixes bug #58650 "Failing assertion: primary_key_no == -1 \|\| primary_key_no == 0" in which incorrect candidate key sorting led to assertion failure in InnoDB code.	15 years ago
Ole John Aske	59269b1da1	Fix for bug#57030: ('BETWEEN' evaluation is incorrect') Root cause for this bug is that the optimizer try to detect& optimize the special case: '<field> BETWEEN c1 AND c1' and handle this as the condition '<field> = c1' This was implemented inside add_key_field(.. field, value[]...) which assumed field to refer key Field, and value[] to refer a [low...high] constant pair. value[0] and value[1] was then compared for equality. In a 'normal' BETWEEN condition of the form '<field> BETWEEN val1 and val2' the BETWEEN operation is represented with an argementlist containing the values [<field>, val1, val2] - add_key_field() is then called with parameters field=<field>, *value=val1. However, if the BETWEEN predicate specified: 1) '<const1> BETWEEN<const2> AND<field> the 'field' and 'value' arguments to add_key_field() had to be swapped. This was implemented by trying to cheat add_key_field() to handle it like: 2) '<const1> GE<const2> AND<const1> LE<field>' As we didn't really replace the BETWEEN operation with 'ge' and 'le', add_key_field() still handled it as a 'BETWEEN' and compared the (swapped) arguments<const1> and<const2> for equality. If they was equal, the condition 1) was incorrectly 'optimized' to: 3) '<field> EQ <const1>' This fix moves this optimization of '<field> BETWEEN c1 AND c1' into add_key_fields() which then calls add_key_equal_fields() to collect key equality / comparison for the key fields in the BETWEEN condition.	15 years ago
Mattias Jonsson	d83706bc74	minor fix of copyright header	15 years ago
Alfranio Correia	8ce9b99246	BUG#59338 Inconsistency in binlog for statements that don't change any rows STATEMENT SBR In SBR, if a statement does not fail, it is always written to the binary log, regardless if rows are changed or not. If there is a failure, a statement is only written to the binary log if a non-transactional (.e.g. MyIsam) engine is updated. INSERT ON DUPLICATE KEY UPDATE and INSERT IGNORE were not following the rule above and were not written to the binary log, if then engine was Innodb. mysql-test/extra/rpl_tests/rpl_insert_duplicate.test: Added test case. mysql-test/extra/rpl_tests/rpl_insert_ignore.test: Updated test case. mysql-test/include/commit.inc: Updated test case as the calls to the binary log have changed for INSERT ON DUPLICATE and INSERT IGNORE. mysql-test/r/commit_1innodb.result: Updated result file. mysql-test/suite/rpl/r/rpl_insert_duplicate.result: Added test case. mysql-test/suite/rpl/r/rpl_insert_ignore.result: Updated result file. mysql-test/suite/rpl/t/rpl_insert_duplicate.test: Added test case. mysql-test/suite/rpl/t/rpl_insert_ignore.test: Improved test case.	15 years ago
Alfranio Correia	235e10d987	BUG#55675 rpl.rpl_log_pos fails sporadically with error binlog truncated in the middle There are two calls to read_log_event() on master in mysql_binlog_send(). Each call reads 19 bytes in this test case and the error of the second read_log_event() is reported to the slave. The second read_log_event() starts from position 94 (75 + 19) to 113 (75 + 19 + 19). Usually, there are two events in the binary log: . 0 - 3 - Header . 4 - 105 - Format Descriptor Event . 106 - 304 - Query Event and both reads fail because operations are reading from invalid positions as expected. However, mysql_binlog_send() does not use the same IO_CACHE that is used to write into binary log (i.e. mysql_bin_log.log_file) for the hot binary log. It opens the binary log file directly by calling open_binlog() and creates a separated IO_CACHE. So there is a possibly that after a master has flushed the binary log file, the content has been cached by the filesystem, and has not updated the disk file. If this happens, then a slave will only see part of the file, and thus the second read_log_event() will report event truncated error. To fix the problem, if the first read_log_event() has failed, we ensure that the second one will try to read from the same position.	15 years ago
Mattias Jonsson	62ab200343	Update of copyright headers for files I changed this year.	15 years ago
Libing Song	8ec9bbaf59	Postfix bug#49124 Updated the copyright.	15 years ago
unknown	49b7a1f48d	Postfix BUG#58546 Updated Copyright.	15 years ago
Martin Hansson	03db0de64f	Bug#59173: Failure to handle DATE(TIME) values where Year, Month or Day is ZERO When dates are represented internally as strings, i.e. when a string constant is compared to a date value, both values are converted to long integers, ostensibly for fast comparisons. DATE typed integer values are converted to DATETIME by multiplying by 1,000,000 (each digit pair representing hour, minute and second, respectively). But the mechanism did not distuinguish cached INTEGER values, already in correct format, from newly converted strings. Fixed by marking the INTEGER cache as being of DATETIME format.	15 years ago
Libing Song	77bc81b89c	Bug#58546 test rpl_packet timeout failure sporadically on PB rpl_packet got a timeout failure sporadically on PB when stopping slave. The real reason of this bug is that STOP SLAVE stopped IO thread first and then stopped SQL thread. It was possible that IO thread stopped after replicating part of a transaction which SQL thread was executing. SQL thread would be hung if the transaction could not be rolled back safely. After this patch, STOP SLAVE will stop SQL thread first and then stop IO thread, which guarantees that IO thread will fetch the reset of the events of the transaction that SQL thread is executing, so that SQL thread can finish the transaction if it cannot be rolled back safely. Added below auxiliary files to make the test code neater. restart_slave_sql.inc rpl_connection_master.inc rpl_connection_slave.inc rpl_connection_slave1.inc	15 years ago
Alexander Barkov	6665ca25af	Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function Introduced by the fix for bug#44766. Problem: it's not correct to use args[0]->str_value as a buffer, because args[0] may need this buffer for its own purposes. Fix: adding a new class member tmp_value to use as return value. @ mysql-test/r/ctype_many.result @ mysql-test/t/ctype_many.test Adding tests @ sql/item_strfunc.cc Changing code into traditional style: use "str" as a buffer for the argument and tmp_value for the result value. @ sql/item_strfunc.h Adding tmp_value	15 years ago
Alexander Barkov	a2850a2f53	Bug#59149 valgrind warnings with "like .. escape .." function Problem: when processing a query like: SELECT '' LIKE '1' ESCAPE COUNT(1); escape_item->val_str() was never executed and the "escape" class member stayed initialized, which led to valgrind uninitialized memory error. Note, a query with some tables in "FROM" clause returns ER_WRONG_ARGUMENTS in the same situation: SELECT '' LIKE '1' ESCAPE COUNT(1) FROM t1; ERROR 1210 (HY000): Incorrect arguments to ESCAPE Fix: disallowing using aggregate functions in ESCAPE clause, even if there are no tables used. There is no much use of that anyway.	15 years ago
unknown	12c6d1f355	BUG#49124 Security issue with /!-versioned / SQL statements on Slave Backport to 5.0. /![:version:] Query Code /, where [:version:] is a sequence of 5 digits representing the mysql server version(e.g /!50200 ... /), is a special comment that the query in it can be executed on those servers whose versions are larger than the version appearing in the comment. It leads to a security issue when slave's version is larger than master's. A malicious user can improve his privileges on slaves. Because slave SQL thread is running with SUPER privileges, so it can execute queries that he/she does not have privileges on master. This bug is fixed with the logic below: - To replace '!' with ' ' in the magic comments which are not applied on master. So they become common comments and will not be applied on slave. - Example: 'INSERT INTO t1 VALUES (1) /!10000, (2)/ /!99999 ,(3)/ will be binlogged as 'INSERT INTO t1 VALUES (1) /!10000, (2)/ /* 99999 ,(3)*/	15 years ago
Martin Hansson	716b64cdb0	Bug#58165: "my_empty_string" gets modified and causes LOAD DATA to fail and other crashes Some string manipulating SQL functions use a shared string object intended to contain an immutable empty string. This object was used by the SQL function SUBSTRING_INDEX() to return an empty string when one argument was of the wrong datatype. If the string object was then modified by the sql function INSERT(), undefined behavior ensued. Fixed by instead modifying the string object representing the function's result value whenever string manipulating SQL functions return an empty string. Relevant code has also been documented.	15 years ago
Dmitry Lenev	599457ae2c	Fix for bug #58499 "DEFINER-security view selecting from INVOKER-security view access check wrong". When privilege checks were done for tables used from an INVOKER-security view which in its turn was used from a DEFINER-security view connection's active security context was incorrectly used instead of security context with privileges of the second view's creator. This meant that users which had enough rights to access the DEFINER-security view and as result were supposed to be able successfully access it were unable to do so in cases when they didn't have privileges on underlying tables of the INVOKER-security view. This problem was caused by the fact that for INVOKER-security views TABLE_LIST::security_ctx member for underlying tables were set to 0 even in cases when particular view was used from another DEFINER-security view. This meant that when checks of privileges on these underlying tables was done in setup_tables_and_check_access() active connection security context was used instead of context corresponding to the creator of caller view. This fix addresses the problem by ensuring that underlying tables of an INVOKER-security view inherit security context from the view and thus correct security context is used for privilege checks on underlying tables in cases when such view is used from another view with DEFINER-security. mysql-test/r/view_grant.result: Added coverage for various combinations of DEFINER and INVOKER-security views, including test for bug #58499 "DEFINER-security view selecting from INVOKER-security view access check wrong". mysql-test/t/view_grant.test: Added coverage for various combinations of DEFINER and INVOKER-security views, including test for bug #58499 "DEFINER-security view selecting from INVOKER-security view access check wrong". sql/sql_view.cc: When opening a non-suid view ensure that its underlying tables will get the same security context as use for checking privileges on the view, i.e. security context of view invoker. This context can be different from the security context which is currently active for connection in cases when this non-suid view is used from a view with suid security. Inheriting security context in such situation allows correctly apply privileges of creator of suid view in checks for tables of non-suid view (since in this situation creator/definer of suid view serves as invoker for non-suid view).	15 years ago
Alexey Botchkov	33c78e328f	Bug #57321 crashes and valgrind errors from spatial types Item_func_spatial_collection::fix_length_and_dec didn't call parent's method, so the maybe_null was set to '0' after it. But in this case the result was just NULL, that caused wrong behaviour. per-file comments: mysql-test/r/gis.result Bug #57321 crashes and valgrind errors from spatial types test result updated. mysql-test/t/gis.test Bug #57321 crashes and valgrind errors from spatial types test case added. sql/item_geofunc.h Bug #57321 crashes and valgrind errors from spatial types Item_func_geometry::fix_length_and_dec() called in Item_func_spatial_collection::fix_length_and_dec().	15 years ago
Martin Hansson	3c5662c195	Bug#58207: invalid memory reads when using default column value and tmptable needed The function DEFAULT() works by modifying the the data buffer pointers (often referred to as 'record' or 'table record') of its argument. This modification is done during name resolution (fix_fields().) Unfortunately, the same modification is done when creating a temporary table, because default values need to propagate to the new table. Fixed by skipping the pointer modification for fields that are arguments to the DEFAULT function.	15 years ago
Dmitry Shulga	0fd846bad0	Fixed Bug#58887 - server not throwing "Packet too large" error if max_allowed_packet >= 16M. This bug was introduced by patch for bug#42503. This patch restores behaviour that there was before patch for bug#42503 was applied. sql/net_serv.cc: Restored original right condition.	15 years ago
Jan Wedvik	0a7cfad080	Fix for bug#58553, "Queries with pushed conditions causes 'explain extended' to crash mysqld". handler::pushed_cond was not always properly reset when table objects where recycled via the table cache. handler::pushed_cond is now set to NULL in handler::ha_reset(). This should prevent pushed conditions from (incorrectly) re-apperaring in later queries.	15 years ago
Mattias Jonsson	c574a9c414	Bug#57924: crash when creating partitioned table with multiple columns in the partition key ndb crash if duplicate columns in the partitioning key. Backport from mysql-5.1-telco-7.0, see bug#53354. Changed from case sensitive field name comparision to non case sensitive too. mysql-test/r/partition_error.result: updated result mysql-test/t/partition_error.test: Added test for the error in non-ndb partitioned table. sql/sql_partition.cc: Added check for duplicated field names in the partitioning key.	15 years ago
Davi Arnaut	998065c3a6	Bug#51023: Mysql server crashes on SIGHUP and destroys InnoDB files From a user perspective, the problem is that a FLUSH LOGS or SIGHUP signal could end up associating the stdout and stderr to random files. In the case of this bug report, the streams would end up associated to InnoDB ibd files. The freopen(3) function is not thread-safe on FreeBSD. What this means is that if another thread calls open(2) during freopen() is executing that another thread's fd returned by open(2) may get re-associated with the file being passed to freopen(3). See FreeBSD PR number 79887 for reference: http://www.freebsd.org/cgi/query-pr.cgi?pr=79887 This problem is worked around by substituting a internal hook within the FILE structure. This avoids the loss of atomicity by not having the original fd closed before its duplicated. Patch based on the original work by Vasil Dimov. include/my_sys.h: Export my_freopen. mysys/my_fopen.c: Add a my_freopen abstraction to workaround bugs in specific OSes. Add a prototype for getosreldate() as older FreeBSD versions did not define one. sql/log.cc: Move freopen abstraction code over to mysys. The streams are now only reopened for writing.	15 years ago
unknown	cafdf6e6d2	43818 - Patch for mysql-5.1-innodb Avoid handler::info() call for three Information Schema tables; TABLE_CONSTRAINTS, KEY_COLUMN_USAGE, & REFERENTIAL_CONTRAINTS	15 years ago
unknown	22639a066c	Bug #50914 mysqlbinlog not handling drop of current default database mysqlbinlog only prints "use $database" statements to its output stream when the active default database changes between events. This will cause "No Database Selected" error when dropping and recreating that database. To fix the problem, we clear print_event_info->db when printing an event of CREATE/DROP/ALTER database statements, so that the Query_log_event after such statements will be printed with the use 'db' anyway except transaction keywords. mysql-test/r/mysqlbinlog.result: Test result for Bug#50914. mysql-test/t/mysqlbinlog.test: Added test to verify if the approach of the mysqlbinlog prints "use $database" statements to its output stream will cause "No Database Selected" error when dropping and recreating that database. sql/log_event.cc: Updated code to clear print_event_info->db when printing an event of CREATE/DROP/ALTER database statements, so that the Query_log_event after such statements will be printed with the use 'db' anyway except transaction keywords.	15 years ago
Kent Boortz	85323eda8a	- Added/updated copyright headers - Removed files specific to compiling on OS/2 - Removed files specific to SCO Unix packaging - Removed "libmysqld/copyright", text is included in documentation - Removed LaTeX headers for NDB Doxygen documentation - Removed obsolete NDB files - Removed "mkisofs" binaries - Removed the "cvs2cl.pl" script - Changed a few GPL texts to use "program" instead of "library"	15 years ago
Sergey Glukhov	bc56dcea9d	Bug#57810 case/when/then : Assertion failed: length \|\| !scale ASSERT happens due to improper calculation of the max_length in Item_func_div object, if dividend has max_length == 0 then Item_func_div::max_length is set to 0 under some circumstances. The fix: If decimals == NOT_FIXED_DEC then set Item_func_div::max_length to max possible DOUBLE length value. mysql-test/r/func_math.result: test case mysql-test/t/func_math.test: test case sql/item_func.cc: The fix: If decimals == NOT_FIXED_DEC then set Item_func_div::max_length to max possible DOUBLE length value.	15 years ago
Mattias Jonsson	8715503810	Bug#54483: valgrind errors when making warnings for multiline inserts into partition Bug#57071: EXTRACT(WEEK from date_col) cannot be allowed as partitioning function Renamed function according to reviewers comments. sql/item.h: better name of processor function sql/item_func.h: better name of processor function sql/item_timefunc.h: better name of processor function sql/sql_partition.cc: better name of processor function Updated comment.	15 years ago
Mattias Jonsson	1615419d72	Bug#54483: valgrind errors when making warnings for multiline inserts into partition Bug#57071: EXTRACT(WEEK from date_col) cannot be allowed as partitioning function There were functions allowed as partitioning functions that implicit allowed cast. That could result in unacceptable behaviour. Solution was to check that the arguments of date and time functions have allowed types (field and date/datetime/time depending on function). mysql-test/r/partition.result: Updated result mysql-test/r/partition_error.result: Updated result mysql-test/suite/parts/inc/part_supported_sql_funcs_main.inc: disabled test with not allowed arguments. mysql-test/suite/parts/r/part_supported_sql_func_innodb.result: Updated result mysql-test/suite/parts/r/part_supported_sql_func_myisam.result: Updated result mysql-test/t/partition.test: Fixed typo in bug number and removed non allowed function (bad argument) mysql-test/t/partition_error.test: Added tests to verify correct type of argument. sql/item.h: Renamed processor since it is no longer only for timezone sql/item_func.h: Added help functions for checking date/time/datetime arguments. sql/item_timefunc.h: Added processors for argument correctness sql/sql_partition.cc: renamed the processor for checking arguments.	15 years ago
Sergey Glukhov	e2db8e6ccb	Bug#58030 crash in Item_func_geometry_from_text::val_str Item_sum_max/Item_sum_min incorrectly set null_value flag and attempt to get result in parent functions leads to crash. This happens due to double evaluation of the function argumet. First evaluation happens in the comparator and second one happens in Item_cache::cache_value(). The fix is to introduce new Item_cache object which holds result of the argument and use this cached value as an argument of the comparator. mysql-test/r/func_group.result: test case mysql-test/t/func_group.test: test case sql/item.cc: added assertion that ether we have some result or result is NULL. sql/item_sum.cc: introduce new Item_cache object which holds result of the argument and use this cached value as an argument of the comparator. sql/item_sum.h: introduce new Item_cache object which holds result of the argument and use this cached value as an argument of the comparator.	15 years ago
unknown	d5bf6b8aa8	Bug #56662 Assertion failed: next_insert_id == 0, file .\handler.cc Normally, auto_increment value is generated for the column by inserting either NULL or 0 into it. NO_AUTO_VALUE_ON_ZERO suppresses this behavior for 0 so that only NULL generates the auto_increment value. This behavior is also followed by a slave, specifically by the SQL Thread, when applying events in the statement format from a master. However, when applying events in the row format, the flag was ignored thus causing an assertion failure: "Assertion failed: next_insert_id == 0, file .\handler.cc" In fact, we never need to generate a auto_increment value for the column when applying events in row format on slave. So we don't allow it to happen by using 'MODE_NO_AUTO_VALUE_ON_ZERO'. Refactoring: Get rid of all the sql_mode checks to rows_log_event when applying it for avoiding problems caused by the inconsistency of the sql_mode on slave and master as the sql_mode is not set for Rows_log_event. mysql-test/extra/rpl_tests/rpl_auto_increment.test: Added test to verify if the assertion of "next_insert_id == 0" will fail in ha_external_lock() function. mysql-test/suite/rpl/r/rpl_auto_increment.result: Test result for bug#56662. sql/log_event.cc: Added code to not allow generation of auto_increment value when processing rows event by adding 'MODE_NO_AUTO_VALUE_ON_ZERO' to sql_mode. sql/rpl_record.cc: Added code to get rid of the 'MODE_STRICT_TRANS_TABLES' and MODE_STRICT_ALL_TABLES check to the table when appling the rows event and treat it as no strict.	15 years ago
Luis Soares	4c0c552582	BUG#46166 Post-push fixes: - fixed platform dependent result files - appeasing valgrind warnings: Fault injection was also uncovering a previously existing potential mem leaks. For BUG#46166 testing purposes, fixed by forcing handling the leak when injecting faults.	15 years ago
Gleb Shchepa	086130e3c0	backport of bug #54476 fix from 5.1-bugteam to 5.0-bugteam. Original revid: alexey.kopytov@sun.com-20100723115254-jjwmhq97b9wl932l > Bug #54476: crash when group_concat and 'with rollup' in > prepared statements > > Using GROUP_CONCAT() together with the WITH ROLLUP modifier > could crash the server. > > The reason was a combination of several facts: > > 1. The Item_func_group_concat class stores pointers to ORDER > objects representing the columns in the ORDER BY clause of > GROUP_CONCAT(). > > 2. find_order_in_list() called from > Item_func_group_concat::setup() modifies the ORDER objects so > that their 'item' member points to the arguments list > allocated in the Item_func_group_concat constructor. > > 3. In some cases (e.g. in JOIN::rollup_make_fields) a copy of > the original Item_func_group_concat object could be created by > using the Item_func_group_concat::Item_func_group_concat(THD > thd, Item_func_group_concat item) copy constructor. The > latter essentially creates a shallow copy of the source > object. Memory for the arguments array is allocated on > thd->mem_root, but the pointers for arguments and ORDER are > copied verbatim. > > What happens in the test case is that when executing the query > for the first time, after a copy of the original > Item_func_group_concat object has been created by > JOIN::rollup_make_fields(), find_order_in_list() is called for > this new object. It then resolves ORDER BY by modifying the > ORDER objects so that they point to elements of the arguments > array which is local to the cloned object. When thd->mem_root > is freed upon completing the execution, pointers in the ORDER > objects become invalid. Those ORDER objects, however, are also > shared with the original Item_func_group_concat object which is > preserved between executions of a prepared statement. So the > first call to find_order_in_list() for the original object on > the second execution tries to dereference an invalid pointer. > > The solution is to create copies of the ORDER objects when > copying Item_func_group_concat to not leave any stale pointers > in other instances with different lifecycles. mysql-test/r/func_gconcat.result: Test case for bug #54476. mysql-test/t/func_gconcat.test: Test case for bug #54476. sql/item_sum.cc: Copy the ORDER objects pointed to by the elements of the 'order' array in the copy constructor of Item_func_group_concat. sql/table.h: Removed the unused 'item_copy' member of the ORDER class.	15 years ago
Luis Soares	92a0463edb	BUG 46697 Addressing review comments.	15 years ago
Sergey Glukhov	76627d5fc3	Bug#57818 string conversion function died Bug#57913 large negative number to string conversion functions crash String object which is used as result container of the item has uninitialized 'str_charset' field. This object might be used later to preform some internal operations and str_charset field is involved in these operations. It leads to crash. The fix is to intialize str_charset in my_decimal2string() func. mysql-test/r/func_str.result: test case mysql-test/t/func_str.test: test case sql/my_decimal.cc: intialize str_charset field for result string in my_decimal2string() func.	15 years ago
Sergey Glukhov	fcb83cbf15	Fixed following problems: --Bug#52157 various crashes and assertions with multi-table update, stored function --Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb --Bug#57703 create view cause Assertion failed: 0, file .\item_subselect.cc, line 846 --Bug#57352 valgrind warnings when creating view --Recently discovered problem when a nested materialized derived table is used before being populated and it leads to incorrect result We have several modes when we should disable subquery evaluation. The reasons for disabling are different. It could be uselessness of the evaluation as in case of 'CREATE VIEW' or 'PREPARE stmt', or we should disable subquery evaluation if tables are not locked yet as it happens in bug#54475, or too early evaluation of subqueries can lead to wrong result as it happened in Bug#19077. Main problem is that if subquery items are treated as const they are evaluated in ::fix_fields(), ::fix_length_and_dec() of the parental items as a lot of these methods have Item::val_...() calls inside. We have to make subqueries non-const to prevent unnecessary subquery evaluation. At the moment we have different methods for this. Here is a list of these modes: 1. PREPARE stmt; We use UNCACHEABLE_PREPARE flag. It is set during parsing in sql_parse.cc, mysql_new_select() for each SELECT_LEX object and cleared at the end of PREPARE in sql_prepare.cc, init_stmt_after_parse(). If this flag is set subquery becomes non-const and evaluation does not happen. 2. CREATE\|ALTER VIEW, SHOW CREATE VIEW, I_S tables which process FRM files We use LEX::view_prepare_mode field. We set it before view preparation and check this flag in ::fix_fields(), ::fix_length_and_dec(). Some bugs are fixed using this approach, some are not(Bug#57352, Bug#57703). The problem here is that we have a lot of ::fix_fields(), ::fix_length_and_dec() where we use Item::val_...() calls for const items. 3. Derived tables with subquery = wrong result(Bug19077) The reason of this bug is too early subquery evaluation. It was fixed by adding Item::with_subselect field The check of this field in appropriate places prevents const item evaluation if the item have subquery. The fix for Bug19077 fixes only the problem with convert_constant_item() function and does not cover other places(::fix_fields(), ::fix_length_and_dec() again) where subqueries could be evaluated. Example: CREATE TABLE t1 (i INT, j BIGINT); INSERT INTO t1 VALUES (1, 2), (2, 2), (3, 2); SELECT * FROM (SELECT MIN(i) FROM t1 WHERE j = SUBSTRING('12', (SELECT * FROM (SELECT MIN(j) FROM t1) t2))) t3; DROP TABLE t1; 4. Derived tables with subquery where subquery is evaluated before table locking(Bug#54475, Bug#52157) Suggested solution is following: -Introduce new field LEX::context_analysis_only with the following possible flags: #define CONTEXT_ANALYSIS_ONLY_PREPARE 1 #define CONTEXT_ANALYSIS_ONLY_VIEW 2 #define CONTEXT_ANALYSIS_ONLY_DERIVED 4 -Set/clean these flags when we perform context analysis operation -Item_subselect::const_item() returns result depending on LEX::context_analysis_only. If context_analysis_only is set then we return FALSE that means that subquery is non-const. As all subquery types are wrapped by Item_subselect it allow as to make subquery non-const when it's necessary. mysql-test/r/derived.result: test case mysql-test/r/multi_update.result: test case mysql-test/r/view.result: test case mysql-test/suite/innodb/r/innodb_multi_update.result: test case mysql-test/suite/innodb/t/innodb_multi_update.test: test case mysql-test/suite/innodb_plugin/r/innodb_multi_update.result: test case mysql-test/suite/innodb_plugin/t/innodb_multi_update.test: test case mysql-test/t/derived.test: test case mysql-test/t/multi_update.test: test case mysql-test/t/view.test: test case sql/item.cc: --removed unnecessary code sql/item_cmpfunc.cc: --removed unnecessary checks --THD::is_context_analysis_only() is replaced with LEX::is_ps_or_view_context_analysis() sql/item_func.cc: --refactored context analysis checks sql/item_row.cc: --removed unnecessary checks sql/item_subselect.cc: --removed unnecessary code --added DBUG_ASSERT into Item_subselect::exec() which asserts that subquery execution can not happen if LEX::context_analysis_only is set, i.e. at context analysis stage. --Item_subselect::const_item() Return FALSE if LEX::context_analysis_only is set. It prevents subquery evaluation in ::fix_fields & ::fix_length_and_dec at context analysis stage. sql/item_subselect.h: --removed unnecessary code sql/mysql_priv.h: --Added new set of flags. sql/sql_class.h: --removed unnecessary code sql/sql_derived.cc: --added LEX::context_analysis_only analysis intialization/cleanup sql/sql_lex.cc: --init LEX::context_analysis_only field sql/sql_lex.h: --New LEX::context_analysis_only field sql/sql_parse.cc: --removed unnecessary code sql/sql_prepare.cc: --removed unnecessary code --added LEX::context_analysis_only analysis intialization/cleanup sql/sql_select.cc: --refactored context analysis checks sql/sql_show.cc: --added LEX::context_analysis_only analysis intialization/cleanup sql/sql_view.cc: --added LEX::context_analysis_only analysis intialization/cleanup	15 years ago
Sergey Glukhov	1faf910eeb	Bug#39828 : Autoinc wraps around when offset and increment > 1 Auto increment value wraps when performing a bulk insert with auto_increment_increment and auto_increment_offset greater than one. The fix: If overflow happened then return MAX_ULONGLONG value as an indication of overflow and check this before storing the value into the field in update_auto_increment(). mysql-test/r/auto_increment.result: test case mysql-test/suite/innodb/r/innodb-autoinc.result: test case fix mysql-test/suite/innodb/t/innodb-autoinc.test: test case fix mysql-test/suite/innodb_plugin/r/innodb-autoinc.result: test case fix mysql-test/suite/innodb_plugin/t/innodb-autoinc.test: test case fix mysql-test/t/auto_increment.test: test case sql/handler.cc: If overflow happened then return MAX_ULONGLONG value as an indication of overflow and check this before storing the value into the field in update_auto_increment().	15 years ago
Sergey Glukhov	6330815a0c	Bug#58396 group_concat and explain extended are still crashy Explain fails at fix_fields stage and some items are left unfixed, particulary Item_group_concat. Item_group_concat::orig_args field is uninitialized in this case and Item_group_concat::print call leads to crash. The fix: move the initialization of Item_group_concat::orig_args into constructor. mysql-test/r/func_gconcat.result: test case mysql-test/t/func_gconcat.test: test case sql/item_sum.cc: move the initialization of Item_group_concat::orig_args into constructor.	15 years ago
Luis Soares	ffc16a2d06	BUG#46166 Post merge fix. In write_incident, check if binlog file is opened before actually trying to write the incident event.	15 years ago
Dmitry Shulga	5ca6880def	Fixed bug#54486 - assert in my_seek, concurrent DROP/CREATE SCHEMA, CREATE TABLE, REPAIR. The cause of assert was concurrent execution of DROP DATABASE and REPAIR TABLE where first statement deleted table's file .TMD at the same time as REPAIR TABLE tried to read file details from the old file that was just removed. Additionally was fixed trouble when DROP TABLE try delete all files belong to table being dropped at the same time when REPAIR TABLE statement has just deleted .TMD file. No regression test added because this would require adding a sync point to mysys/my_redel.c. Since this bug is not present in 5.5+, adding test coverage was considered unnecessary. The patch has been verified using RQG testing. sql/sql_db.cc: mysql_rm_known_files() modified: ignore possible ENOENT error when trying delete all table's files. Such aggressive algorithm permits skip already deleted (in another thread) files. Installation of Drop_table_error_handler as internal error handler moved from mysql_rm_db() to mysql_rm_knowns_files() near to place where source of possible errors (call to mysql_rm_table_part2) located. storage/myisam/mi_check.c: mi_repair() was modified: set param->retry_repair= 0 in order to don't call following failover procedure in ha_myisam::repair().	15 years ago
Luis Soares	844138c90b	BUG#46697: Table name in error message is not populated When a query fails with a different error on the slave, the sql thread outputs a message (M) containing: 1. the error message format for the master error code 2. the master error code 3. the error message for the slave's error code 4. the slave error code Given that the slave has no information on the error message itself that the master outputs, it can only print its own version of the message format (but stripped from the additional data if the message format requires). This may confuse users. To fix this we augment the slave's message (M) to explicitly state that the master's message is actually an error message format, the one associated with the given master error code and that the slave server knows about.	15 years ago
Tor Didriksen	d56a6dd027	BUG#58246 post-push fix broken DBG build.	15 years ago
Mats Kindahl	fc9f3efaec	BUG#58246: INSTALL PLUGIN not secure & crashable When installing plugins, there is a missing check for slash (/) in the path on Windows. Note that on Windows, both / and \ can be used to separate directories. This patch fixes the issue by: - Adding a FN_DIRSEP symbol for all platforms consisting of a string of legal directory separators. - Adding a charset-aware version of strcspn(). - Adding a check_valid_path() function that uses my_strcspn() to check if any FN_DIRSEP character is in the supplied string. - Using the check_valid_path() function in sql_plugin.cc and sql_udf.cc (which means replacing the existing test there). include/config-netware.h: Adding FN_DIRSEP **** Adding FN_DIRSEP include/config-win.h: Adding FN_DIRSEP ** Adding FN_DIRSEP include/m_ctype.h: Adding my_strspn() and my_strcspn(). ** Adding my_strspn() and my_strcspn(). include/my_global.h: Adding FN_DIRSEP **** Adding FN_DIRSEP mysql-test/t/plugin_not_embedded.test: Adding test that file names containing / is disallowed on all platforms. ****** Adding test that file names containing / is disallowed on all platforms. sql/sql_plugin.cc: Introducing check_if_path() function for checking if filename is a path to include / on Windows. **** Introducing check_if_path() function for checking if filename is a path to include / on Windows. sql/sql_udf.cc: Switching to use check_if_path() function. ** Switching to use check_if_path() function. strings/my_strchr.c: Adding my_strspn() and my_strcspn(). **** Adding my_strspn() and my_strcspn().	15 years ago
Mattias Jonsson	db830d26b3	Bug#56380: valgrind memory leak warning from partition tests There could be memory leaks if ALTER ... PARTITION command fails. Problem was that the list of items to free was not set in the partition info structure when fix_partition_func call failed during ALTER ... PARTITION. Solved by always setting the list in the partition info struct. sql/table.cc: item_free_list is not set if (!work_part_info_used) and fix_partition_func failed. Which may result in a mem leak.	15 years ago
Luis Soares	647c619393	BUG#46166: MYSQL_BIN_LOG::new_file_impl is not propagating error when generating new name. If find_uniq_filename returns an error, then this error is not being propagated upwards, and execution does not report error to the user (although a entry in the error log is generated). Additionally, some more errors were ignored in new_file_impl: - when writing the rotate event - when reopening the index and binary log file This patch addresses this by propagating the error up in the execution stack. Furthermore, when rotation of the binary log fails, an incident event is written, because there may be a chance that some changes for a given statement, were not properly logged. For example, in SBR, LOAD DATA INFILE statement requires more than one event to be logged, should rotation fail while logging part of the LOAD DATA events, then the logged data would become inconsistent with the data in the storage engine. mysql-test/include/restart_mysqld.inc: Refactored restart_mysqld so that it is not hardcoded for mysqld.1, but rather for the current server. mysql-test/suite/binlog/t/binlog_index.test: The error on open of index and binary log on new_file_impl is now caught. Thence the user will get an error message. We need to accomodate this change in the test case for the failing FLUSH LOGS. mysql-test/suite/rpl/t/rpl_binlog_errors-master.opt: Sets max_binlog_size to 4096. mysql-test/suite/rpl/t/rpl_binlog_errors.test: Added some test cases for asserting that the error is found and reported. sql/handler.cc: Catching error now returned by unlog (in ha_commit_trans) and returning it. sql/log.cc: Propagating errors from new_file_impl upwards. The errors that new_file_impl catches now are: - error on generate_new_name - error on writing the rotate event - error when opening the index or the binary log file. sql/log.h: Changing declaration of: - rotate_and_purge - new_file - new_file_without_locking - new_file_impl - unlog They now return int instead of void. sql/mysql_priv.h: Change signature of reload_acl_and_cache so that write_to_binlog is an int instead of bool. sql/mysqld.cc: Redeclaring not_used var as int instead of bool. sql/rpl_injector.cc: Changes to catch the return from rotate_and_purge. sql/slave.cc: Changes to catch the return values for new_file and rotate_relay_log. sql/slave.h: Changes to rotate_relay_log declaration (now returns int instead of void). sql/sql_load.cc: In SBR, some logging of LOAD DATA events goes through IO_CACHE_CALLBACK invocation at mf_iocache.c:_my_b_get. The IO_CACHE implementation is ignoring the return value for from these callbacks (pre_read and post_read), so we need to find out at the end of the execution if the error is set or not in THD. sql/sql_parse.cc: Catching the rotate_relay_log and rotate_and_purge return values. Semantic change in reload_acl_and_cache so that we report errors in binlog interactions through the write_to_binlog output parameter. If there was any failure while rotating the binary log, we should then report the error to the client when handling SQLCOMM_FLUSH.	15 years ago
Christopher Powers	e199c7cd17	Bug#35333, "If Federated table can't connect to remote host, can't retrieve metadata" Improved error handling such that queries against Information_Schema.Tables won't fail if a Federated table is unable to connect to remote host. sql/sql_show.cc: If Handler::Info() fails, save error text in TABLE COMMENTS column, clear error.	15 years ago
unknown	f225470b39	BUG#54903 BINLOG statement toggles session variables When using BINLOG statement to execute rows log events, session variables foreign_key_checks and unique_checks are changed temporarily. As each rows log event has their own special session environment and its own foreign_key_checks and unique_checks can be different from current session which executing the BINLOG statement. But these variables are not restored correctly after BINLOG statement. This problem will cause that the following statements fail or generate unexpected data. In this patch, code is added to backup and restore these two variables. So BINLOG statement will not affect current session's variables again. mysql-test/extra/binlog_tests/binlog.test: Add test to verify this patch. mysql-test/suite/binlog/r/binlog_row_binlog.result: Add test to verify this patch. mysql-test/suite/binlog/r/binlog_stm_binlog.result: Add test to verify this patch. sql/sql_binlog.cc: Add code to backup and restore thd->options.	15 years ago
Davi Arnaut	d5e928959e	Bug#51817: incorrect assumption: thd->query at 0x2ab2a8360360 is an invalid pointer The problem is that the logic which checks if a pointer is valid relies on a poor heuristic based on the start and end addresses of the data segment and heap. Apart from miscalculating the heap bounds, this approach also suffers from the fact that memory can come from places other than the heap. See Bug#58528 for a more detailed explanation. On Linux, the solution is to access the process's memory through /proc/self/task/<tid>/mem, which allows for retrieving the contents of pages within the virtual address space of the calling process. If a address range is not mapped, a input/output error is returned. client/mysqltest.cc: Use new interface to my_safe_print_str. include/my_stacktrace.h: Drop name from my_safe_print_str. mysys/stacktrace.c: Access the process's memory through a file descriptor and dump the contents of the memory range. The file descriptor offset is equivalent to a offset into the address space. Do not print the name of the variable associated with the address. It can be better accomplished at a higher level. sql/mysqld.cc: Put the variable dumping information within its own newline block. Use symbolic names which better convey information to the user.	15 years ago
Luis Soares	b009422734	BUG#57288: binlog_tmp_table fails sporadically: "Failed to write the DROP statement ..." Problem: When using temporary tables and closing a session, an implicit DROP TEMPORARY TABLE IF EXISTS is written to the binary log (while cleaning up the context of the session THD - see: sql_class.cc:THD::cleanup which calls close_temporary_tables). close_temporary_tables, first checks if the binary log is opened and then proceeds to creating the DROP statements. Then, such statements, are written to the binary log through MYSQL_BIN_LOG::write(Log_event *). Inside, there is another check if the binary log is opened and if not an error is returned. This is where the faulty behavior is triggered. Given that the test case replays a binary log, with temp tables statements, and right after it issues RESET MASTER, there is a chance that is_open will report false (when the mysql session is closed and the temporary tables are written). is_open may return false, because MYSQL_BIN_LOG::reset_logs is not setting the correct flag (LOG_CLOSE_TO_BE_OPENED), on the MYSQL_LOG_BIN::log_state (instead it sets just the LOG_CLOSE_INDEX flag, leaving the log_state to LOG_CLOSED). Thence, when writing the DROP statement as part of the THD::cleanup, the thread could get a return value of false for is_open - inside MYSQL_BIN_LOG::write, ultimately reporting that it can't write the event to the binary log. Fix: We fix this by adding the correct flag, missing in the second close.	15 years ago

1 2 3 4 5 ...

26452 Commits (994132add6118b8d91893d495a8cb628c1017da4)