Port fix for bug #54044 from mysql-5.1-security to mysql-trunk-security:

------------------------------------------------------------
revno: 3438
committer: Jimmy Yang <jimmy.yang@oracle.com>
branch nick: mysql-5.1-security
timestamp: Thu 2010-06-24 01:20:25 -0700
message:
  Fix Bug #54044 Create temporary tables and using innodb crashes.

mysql-test/suite/innodb/r/innodb_bug54044.result

+CREATE TEMPORARY TABLE TABLE_54044 ENGINE = INNODB
+AS SELECT IF(NULL  IS NOT NULL, NULL, NULL);
+ERROR HY000: Can't create table 'test.TABLE_54044' (errno: -1)

mysql-test/suite/innodb/t/innodb_bug54044.test

+# This is the test for bug #54044. Special handle MYSQL_TYPE_NULL type
+# during create table, so it will not trigger assertion failure.
+
+--source include/have_innodb.inc
+
+# This 'create table' operation should fail because of
+# using NULL datatype
+--error ER_CANT_CREATE_TABLE
+CREATE TEMPORARY TABLE TABLE_54044 ENGINE = INNODB
+ AS SELECT IF(NULL  IS NOT NULL, NULL, NULL); 
+

storage/innobase/handler/ha_innodb.cc

@@ -4143,6 +4143,11 @@ get_innobase_type_from_mysql_type(
 	case MYSQL_TYPE_BLOB:
 	case MYSQL_TYPE_LONG_BLOB:
 		return(DATA_BLOB);
+	case MYSQL_TYPE_NULL:
+		/* MySQL currently accepts "NULL" datatype, but will
+		reject such datatype in the next release. We will cope
+		with it and not trigger assertion failure in 5.1 */
+		break;
 	default:
 		ut_error;
 	}
@@ -6190,7 +6195,22 @@ create_table_def(
 		field = form->field[i];
 
 		col_type = get_innobase_type_from_mysql_type(&unsigned_type,
-									field);
+							     field);
+
+		if (!col_type) {
+			push_warning_printf(
+				(THD*) trx->mysql_thd,
+				MYSQL_ERROR::WARN_LEVEL_WARN,
+				ER_CANT_CREATE_TABLE,
+				"Error creating table '%s' with "
+				"column '%s'. Please check its "
+				"column type and try to re-create "
+				"the table with an appropriate "
+				"column type.",
+				table->name, (char*) field->field_name);
+			goto err_col;
+		}
+
 		if (field->null_ptr) {
 			nulls_allowed = 0;
 		} else {
@@ -6248,7 +6268,7 @@ create_table_def(
 		if (dict_col_name_is_reserved(field->field_name)){
 			my_error(ER_WRONG_COLUMN_NAME, MYF(0),
 				 field->field_name);
-
+err_col:
 			dict_mem_table_free(table);
 			trx_commit_for_mysql(trx);