Bug#26402 Server crashes with old-style named table

  Problem: crash on attempt to open a table
  having "#mysql50#" prefix in db or table name.
  Fix: This prefix is reserved for "mysql_upgrade"
  to access 5.0 tables  whose file names are not encoded
  according to "5.1 tablename to filename encoded".
  Don't try open tables whose db name or table name
  has this prefix.

mysql-test/r/show_check.result

@@ -752,4 +752,6 @@ Tables_in_test	Table_type
 été	BASE TABLE
 drop table `été`;
 set names latin1;
+show columns from `#mysql50#????????`;
+ERROR 42S02: Table 'test.#mysql50#????????' doesn't exist
 End of 5.1 tests

mysql-test/t/show_check.test

@@ -593,4 +593,10 @@ show full tables;
 drop table `été`;
 set names latin1;
 
+#
+# Bug#26402 Server crashes with old-style named table
+#
+--error ER_NO_SUCH_TABLE
+show columns from `#mysql50#????????`;
+
 --echo End of 5.1 tests

sql/mysql_priv.h

@@ -1920,6 +1920,10 @@ uint filename_to_tablename(const char *from, char *to, uint to_length);
 uint tablename_to_filename(const char *from, char *to, uint to_length);
 uint build_table_filename(char *buff, size_t bufflen, const char *db,
                           const char *table, const char *ext, uint flags);
+
+#define MYSQL50_TABLE_NAME_PREFIX         "#mysql50#"
+#define MYSQL50_TABLE_NAME_PREFIX_LENGTH  9
+
 /* Flags for conversion functions. */
 #define FN_FROM_IS_TMP  (1 << 0)
 #define FN_TO_IS_TMP    (1 << 1)

sql/sql_table.cc

@@ -54,10 +54,6 @@ mysql_prepare_alter_table(THD *thd, TABLE *table,
                           HA_CREATE_INFO *create_info,
                           Alter_info *alter_info);
 
-#define MYSQL50_TABLE_NAME_PREFIX         "#mysql50#"
-#define MYSQL50_TABLE_NAME_PREFIX_LENGTH  9
-
-
 /*
   Translate a file name to a table name (WL #1324).
 

sql/table.cc

@@ -343,10 +343,25 @@ int open_table_def(THD *thd, TABLE_SHARE *share, uint db_flags)
   strxmov(path, share->normalized_path.str, reg_ext, NullS);
   if ((file= my_open(path, O_RDONLY | O_SHARE, MYF(0))) < 0)
   {
-    if (strchr(share->table_name.str, '@'))
+    /*
+      We don't try to open 5.0 unencoded name, if
+      - non-encoded name contains '@' signs, 
+        because '@' can be misinterpreted.
+        It is not clear if '@' is escape character in 5.1,
+        or a normal character in 5.0.
+        
+      - non-encoded db or table name contain "#mysql50#" prefix.
+        This kind of tables must have been opened only by the
+        my_open() above.
+    */
+    if (strchr(share->table_name.str, '@') ||
+        !strncmp(share->db.str, MYSQL50_TABLE_NAME_PREFIX,
+                 MYSQL50_TABLE_NAME_PREFIX_LENGTH) ||
+        !strncmp(share->table_name.str, MYSQL50_TABLE_NAME_PREFIX,
+                 MYSQL50_TABLE_NAME_PREFIX_LENGTH))
       goto err_not_open;
 
-    /* Try unecoded 5.0 name */
+    /* Try unencoded 5.0 name */
     uint length;
     strxnmov(path, sizeof(path)-1,
              mysql_data_home, "/", share->db.str, "/",