mariadb

Tree: d2495d1796

Author	SHA1	Message	Date
Jonathan Perkin	d2495d1796	Merge from mysql-5.0.92-release	15 years ago
Georgi Kodinov	0a8419dfdd	Bug #52315 part 2 addendum : reset back the timestamp	15 years ago
Georgi Kodinov	a70c34bf0f	Fixes for Bug #55755 and Bug #52315 part 2 Bug #55755 : Date STD variable signness breaks server on FreeBSD and OpenBSD * Added a check to configure on the size of time_t * Created a macro to check for a valid time_t that is safe to use with datetime functions and store in TIMESTAMP columns. * Used the macro consistently instead of the ad-hoc checks introduced by 52315 * Fixed compliation warnings on platforms where the size of time_t is smaller than the size of a long (e.g. OpenBSD 4.8 64 amd64). Bug #52315: utc_date() crashes when system time > year 2037 * Added a correct check for the timestamp range instead of just variable size check to SET TIMESTAMP. * Added overflow checking before converting to time_t. * Using a correct localized error message in this case instead of the generic error. * Added a test suite. * fixed the checks so that they check for unsigned time_t as well. Used the checks consistently across the source code. * fixed the original test case to expect the new error code.	15 years ago
Ramil Kalimullin	7083cb0bd9	Bug #47811 : remove the non-default alignment specification. Fix backported from to 5.0. "Remove the alignment option, let valgrind use its default" mysql-test/mysql-test-run-shell.sh: Bug #47811 : remove the non-default alignment specification. - backport from 5.1 "Remove the alignment option, let valgrind use its default" mysql-test/mysql-test-run.pl: Bug #47811 : remove the non-default alignment specification. - backport from 5.1 "Remove the alignment option, let valgrind use its default"	15 years ago
Libing Song	8ec9bbaf59	Postfix bug#49124 Updated the copyright.	15 years ago
unknown	12c6d1f355	BUG#49124 Security issue with /!-versioned / SQL statements on Slave Backport to 5.0. /![:version:] Query Code /, where [:version:] is a sequence of 5 digits representing the mysql server version(e.g /!50200 ... /), is a special comment that the query in it can be executed on those servers whose versions are larger than the version appearing in the comment. It leads to a security issue when slave's version is larger than master's. A malicious user can improve his privileges on slaves. Because slave SQL thread is running with SUPER privileges, so it can execute queries that he/she does not have privileges on master. This bug is fixed with the logic below: - To replace '!' with ' ' in the magic comments which are not applied on master. So they become common comments and will not be applied on slave. - Example: 'INSERT INTO t1 VALUES (1) /!10000, (2)/ /!99999 ,(3)/ will be binlogged as 'INSERT INTO t1 VALUES (1) /!10000, (2)/ /* 99999 ,(3)*/	15 years ago
Georgi Kodinov	f949ac55f7	bumped up the version to 5.0.93	15 years ago
Georgi Kodinov	b831c6dbbb	automerge	15 years ago
Alexander Nozdrin	a448580d65	Auto-merge from mysql-5.0-bugteam.	15 years ago
Kent Boortz	85323eda8a	- Added/updated copyright headers - Removed files specific to compiling on OS/2 - Removed files specific to SCO Unix packaging - Removed "libmysqld/copyright", text is included in documentation - Removed LaTeX headers for NDB Doxygen documentation - Removed obsolete NDB files - Removed "mkisofs" binaries - Removed the "cvs2cl.pl" script - Changed a few GPL texts to use "program" instead of "library"	15 years ago
Georgi Kodinov	1e3a4dc105	merge	15 years ago
Georgi Kodinov	9da97a6745	tree details update to main	15 years ago
Martin Hansson	d74e8c5d8b	Merge.	15 years ago
Martin Hansson	ffdeb06272	Bug#54568: create view cause Assertion failed: 0, file .\item_subselect.cc, line 836 IN quantified predicates are never executed directly. They are rather wrapped inside nodes called IN Optimizers (Item_in_optimizer) which take care of the execution. However, this is not done during query preparation. Unfortunately the LIKE predicate pre-evaluates constant right-hand side arguments even during name resolution. Likely this is meant as an optimization. Fixed by not pre-evaluating LIKE arguments in view prepare mode. Back-ported to 5.0s	15 years ago
Alexander Nozdrin	1bd81f6b81	Patch for Bug#57952 (privilege change is not taken into account by EXECUTE). The user-visible problem was that changes to column-level privileges, happened in between of PREPARE and EXECUTE of a prepared statement, were neglected. I.e. a prepared statement could be executed with the column-level privileges as of PREPARE-time. The problem existed for column-level privileges only. A similar problem existed for stored programs: the changes between executions didn't have an effect. Technically the thing is that table references are cached in Prepared_statement::prepare() call. In subsequent Prepared_statement::execute() calls those cached values are used. There are two functions to get a field by name: find_field_in_table() and find_field_in_table_ref(). On prepare-phase find_field_in_table_ref() is called, on execute-phase -- find_field_in_table() because the table is cached. find_field_in_table() does not check column-level privileges and expects the caller to do that. The problem was that this check was forgotten. The fix is to check them there as it happens in find_field_in_table_ref().	15 years ago
Gleb Shchepa	086130e3c0	backport of bug #54476 fix from 5.1-bugteam to 5.0-bugteam. Original revid: alexey.kopytov@sun.com-20100723115254-jjwmhq97b9wl932l > Bug #54476: crash when group_concat and 'with rollup' in > prepared statements > > Using GROUP_CONCAT() together with the WITH ROLLUP modifier > could crash the server. > > The reason was a combination of several facts: > > 1. The Item_func_group_concat class stores pointers to ORDER > objects representing the columns in the ORDER BY clause of > GROUP_CONCAT(). > > 2. find_order_in_list() called from > Item_func_group_concat::setup() modifies the ORDER objects so > that their 'item' member points to the arguments list > allocated in the Item_func_group_concat constructor. > > 3. In some cases (e.g. in JOIN::rollup_make_fields) a copy of > the original Item_func_group_concat object could be created by > using the Item_func_group_concat::Item_func_group_concat(THD > thd, Item_func_group_concat item) copy constructor. The > latter essentially creates a shallow copy of the source > object. Memory for the arguments array is allocated on > thd->mem_root, but the pointers for arguments and ORDER are > copied verbatim. > > What happens in the test case is that when executing the query > for the first time, after a copy of the original > Item_func_group_concat object has been created by > JOIN::rollup_make_fields(), find_order_in_list() is called for > this new object. It then resolves ORDER BY by modifying the > ORDER objects so that they point to elements of the arguments > array which is local to the cloned object. When thd->mem_root > is freed upon completing the execution, pointers in the ORDER > objects become invalid. Those ORDER objects, however, are also > shared with the original Item_func_group_concat object which is > preserved between executions of a prepared statement. So the > first call to find_order_in_list() for the original object on > the second execution tries to dereference an invalid pointer. > > The solution is to create copies of the ORDER objects when > copying Item_func_group_concat to not leave any stale pointers > in other instances with different lifecycles. mysql-test/r/func_gconcat.result: Test case for bug #54476. mysql-test/t/func_gconcat.test: Test case for bug #54476. sql/item_sum.cc: Copy the ORDER objects pointed to by the elements of the 'order' array in the copy constructor of Item_func_group_concat. sql/table.h: Removed the unused 'item_copy' member of the ORDER class.	15 years ago
Georgi Kodinov	3190d45423	Backport of the 5.1 fix for bug #55826 to 5.0	15 years ago
Georgi Kodinov	a4b106c882	Backport of bug #55564 to 5.0-security	15 years ago
Christopher Powers	f688713905	merge	15 years ago
Christopher Powers	e199c7cd17	Bug#35333, "If Federated table can't connect to remote host, can't retrieve metadata" Improved error handling such that queries against Information_Schema.Tables won't fail if a Federated table is unable to connect to remote host. sql/sql_show.cc: If Handler::Info() fails, save error text in TABLE COMMENTS column, clear error.	15 years ago
Georgi Kodinov	2551fff8b2	Fixed bteam issue #37235 : 5.0 trees now will work correctly in pb2 and will not display "indicated result file not found" due to wrongly named var directory.	15 years ago
Georgi Kodinov	6bef32a768	Fixed a pb2 issue with not finding the test dirs.	15 years ago
Gleb Shchepa	a30e9dda78	backport of bug #54461 from 5.1-security to 5.0-security > revision-id: gshchepa@mysql.com-20100801181236-uyuq6ewaq43rw780 > parent: alexey.kopytov@sun.com-20100723115254-jjwmhq97b9wl932l > committer: Gleb Shchepa <gshchepa@mysql.com> > branch nick: mysql-5.1-security > timestamp: Sun 2010-08-01 22:12:36 +0400 > Bug #54461: crash with longblob and union or update with subquery > > Queries may crash, if > 1) the GREATEST or the LEAST function has a mixed list of > numeric and LONGBLOB arguments and > 2) the result of such a function goes through an intermediate > temporary table. > > An Item that references a LONGBLOB field has max_length of > UINT_MAX32 == (2^32 - 1). > > The current implementation of GREATEST/LEAST returns REAL > result for a mixed list of numeric and string arguments (that > contradicts with the current documentation, this contradiction > was discussed and it was decided to update the documentation). > > The max_length of such a function call was calculated as a > maximum of argument max_length values (i.e. UINT_MAX32). > > That max_length value of UINT_MAX32 was used as a length for > the intermediate temporary table Field_double to hold > GREATEST/LEAST function result. > > The Field_double::val_str() method call on that field > allocates a String value. > > Since an allocation of String reserves an additional byte > for a zero-termination, the size of String buffer was > set to (UINT_MAX32 + 1), that caused an integer overflow: > actually, an empty buffer of size 0 was allocated. > > An initialization of the "first" byte of that zero-size > buffer with '\0' caused a crash. > > The Item_func_min_max::fix_length_and_dec() has been > modified to calculate max_length for the REAL result like > we do it for arithmetical operators. mysql-test/r/func_misc.result: Test case for bug #54461. mysql-test/t/func_misc.test: Test case for bug #54461. sql/item_func.cc: Bug #54461: crash with longblob and union or update with subquery The Item_func_min_max::fix_length_and_dec() has been modified to calculate max_length for the REAL result like we do it for arithmetical operators.	15 years ago
Alexander Nozdrin	14b38121c3	A follow-up for Bug#58339 (Replace Server GPL README file). Fix formatting issues in README file.	15 years ago
Alexander Nozdrin	523a47457b	Merge from mysql-5.0-bugteam.	15 years ago
Alexander Nozdrin	85f855e0ed	A follow-up for Bug#58340 (Remove Server GPL EXCEPTIONS-CLIENT file) -- remove all EXCEPTIONS-CLIENT from all the places.	15 years ago
Ramil Kalimullin	787e41d2c1	Auto-merge with mysql-5.0-bugteam.	15 years ago
Gleb Shchepa	47bb750c9d	backport: Bug #55568 from 5.1-security to 5.0-security > revision-id: alexey.kopytov@sun.com-20100824103548-ikm79qlfrvggyj9h > parent: sunny.bains@oracle.com-20100816001222-xqc447tr6jwh8c53 > committer: Alexey Kopytov <Alexey.Kopytov@Sun.com> > branch nick: 5.1-security > timestamp: Tue 2010-08-24 14:35:48 +0400 > message: > Bug #55568: user variable assignments crash server when used > within query > > The server could crash after materializing a derived table > which requires a temporary table for grouping. > > When destroying the temporary table used to execute a query for > a derived table, JOIN::destroy() did not clean up Item_fields > pointing to fields in the temporary table. This led to > dereferencing a dangling pointer when printing out the items > tree later in the outer SELECT. > > The solution is an addendum to the patch for bug37362: in > addition to cleaning up items in tmp_all_fields3, do the same > for items in tmp_all_fields1, since now we have an example > where this is necessary. sql/field.cc: Make sure field->table_name is not set to NULL in Field::make_field() to avoid assertion failure in Item_field::make_field() after cleaning up items (the assertion fired in udf.test when running the test suite with the patch applied). sql/sql_select.cc: In addition to cleaning up items in tmp_all_fields3, do the same for items in tmp_all_fields1. Introduce a new helper function to avoid code duplication. sql/sql_select.h: Introduce a new helper function to avoid code duplication in JOIN::destroy().	15 years ago
Alexander Nozdrin	e9cb14694e	Patch for Bug#58340 (Remove Server GPL EXCEPTIONS-CLIENT file).	15 years ago
Alexander Nozdrin	c913f5bd3f	Patch for Bug#58339 (Replace Server GPL README file).	15 years ago
Sergey Glukhov	50a3c55ee7	Bug#52711 Segfault when doing EXPLAIN SELECT with union...order by (select... where...) backport from 5.1 mysql-test/r/subselect.result: backport from 5.1 mysql-test/t/subselect.test: backport from 5.1 sql/sql_select.cc: backport from 5.1	15 years ago
Sergey Glukhov	0a29baba4b	Fix for bug #54575 : crash when joining tables with unique set column(backport from 5.1) Problem: a flaw (derefencing a NULL pointer) in the LIKE optimization code may lead to a server crash in some rare cases. Fix: check the pointer before its dereferencing. mysql-test/r/func_like.result: Fix for bug #54575: crash when joining tables with unique set column - test result. mysql-test/t/func_like.test: Fix for bug #54575: crash when joining tables with unique set column - test case. sql/item_cmpfunc.cc: Fix for bug #54575: crash when joining tables with unique set column - check res2 buffer pointer before its dereferencing as it may be NULL in some cases.	15 years ago
Georgi Kodinov	33ec6f801b	merge to 5.0-security	15 years ago
Georgi Kodinov	67cbe257f7	Bug #56428 : Replace copyright notice removed from SHA1 code (.h)	15 years ago
Georgi Kodinov	56dfe7295f	Bug #56427 : Replace copyright notice removed from SHA1 code	15 years ago
Georgi Kodinov	cb49825d10	Disable NDB tests to run by default.	15 years ago
Georgi Kodinov	58a8c4b36e	merge	15 years ago
Georgi Kodinov	2bd3d75ad5	merge	15 years ago
Georgi Kodinov	162b3837d5	merge	15 years ago
Georgi Kodinov	645ded9d4b	Bug #55809 : Server README not current Updated the README file.	15 years ago
Georgi Kodinov	e2729eb4d4	tree name update	15 years ago
Georgi Kodinov	e1feae1db9	merge	15 years ago
Davi Arnaut	a6f726c585	Bug#54041: MySQL 5.0.92 fails when tests from Connector/C suite run Fix a regression (due to a typo) which caused spurious incorrect argument errors for long data stream parameters if all forms of logging were disabled (binary, general and slow logs). sql/sql_prepare.cc: Add a missing logical NOT operator.	15 years ago
Georgi Kodinov	0269b747fc	merge	16 years ago
Georgi Kodinov	d3d32008b8	merge	16 years ago
Alexey Kopytov	4c28b67768	Backport of the fix for bug#25421 to 5.0. Calculating the estimated number of records for a range scan may take a significant time, and it was impossible for a user to interrupt that process by killing the connection or the query. Fixed by checking the thread's 'killed' status in check_quick_keys() and interrupting the calculation process if it is set to a non-zero value.	16 years ago
Vasil Dimov	b2318bce9e	Merge the fix for Bug#49238 from SVN (without the unrelated whitespace changes): ------------------------------------------------------------------------ r7009 \| jyang \| 2010-04-29 20:44:56 +0300 (Thu, 29 Apr 2010) \| 6 lines branches/5.0: Port fix for bug #49238 (Creating/Dropping a temporary table while at 1023 transactions will cause assert) from 5.1 to branches/5.1. Separate action for return value DB_TOO_MANY_CONCURRENT_TRXS from that of DB_MUST_GET_MORE_FILE_SPACE in row_drop_table_for_mysql(). ------------------------------------------------------------------------	16 years ago
Georgi Kodinov	0f5fed201f	merge	16 years ago
Georgi Kodinov	eb2c861d8b	merge	16 years ago
Georgi Kodinov	ecc2d2793f	merge	16 years ago

1 2 3 4 5 ...

40403 Commits (d2495d17961995cf661ff7e1e89738b922fefe93) All Branches Search

40403 Commits (d2495d17961995cf661ff7e1e89738b922fefe93)

All Branches