Bug #30269 Query cache eats memory

Although the query cache doesn't support retrieval of statements containing
column level access control, it was still possible to cache such statements
thus wasting memory.

This patch extends the access control check on the target tables to avoid
caching a statement with column level restrictions. 

mysql-test/r/query_cache.result

@@ -1502,6 +1502,30 @@ a	(select count(*) from t2)
 3	0
 4	0
 drop table t1,t2;
+DROP DATABASE IF EXISTS bug30269;
+CREATE DATABASE bug30269;
+USE bug30269;
+CREATE TABLE test1 (id int, name varchar(23));
+CREATE VIEW view1 AS SELECT id FROM test1;
+INSERT INTO test1 VALUES (5, 'testit');
+GRANT SELECT (id) ON TABLE bug30269.test1 TO 'bug30269'@'localhost';
+GRANT SELECT ON TABLE bug30269.view1 TO 'bug30269'@'localhost';
+set global query_cache_size= 81920;
+USE bug30269;
+show status like 'Qcache_queries_in_cache';
+Variable_name	Value
+Qcache_queries_in_cache	0
+SELECT id FROM test1 WHERE id>2;
+id
+5
+SELECT id FROM view1 WHERE id>2;
+id
+5
+show status like 'Qcache_queries_in_cache';
+Variable_name	Value
+Qcache_queries_in_cache	0
+DROP DATABASE bug30269;
+DROP USER 'bug30269'@'localhost';
 set GLOBAL query_cache_type=default;
 set GLOBAL query_cache_limit=default;
 set GLOBAL query_cache_min_res_unit=default;

mysql-test/t/query_cache.test

@@ -1096,9 +1096,37 @@ connection default;
 disconnect user1;
 disconnect user2;
 disconnect user3;
+
+#
+# Bug #30269 Query cache eats memory
+#
+--disable_warnings
+DROP DATABASE IF EXISTS bug30269;
+--enable_warnings
+CREATE DATABASE bug30269;
+USE bug30269;
+CREATE TABLE test1 (id int, name varchar(23));
+CREATE VIEW view1 AS SELECT id FROM test1;
+INSERT INTO test1 VALUES (5, 'testit');
+GRANT SELECT (id) ON TABLE bug30269.test1 TO 'bug30269'@'localhost';
+GRANT SELECT ON TABLE bug30269.view1 TO 'bug30269'@'localhost';
+set global query_cache_size= 81920;
+connect (bug30269, localhost, bug30269,,);
+connection bug30269;
+USE bug30269;
+show status like 'Qcache_queries_in_cache';
+SELECT id FROM test1 WHERE id>2;
+SELECT id FROM view1 WHERE id>2;
+show status like 'Qcache_queries_in_cache';
+
+connection default;
+DROP DATABASE bug30269;
+disconnect bug30269;
+DROP USER 'bug30269'@'localhost';
+
 set GLOBAL query_cache_type=default;
 set GLOBAL query_cache_limit=default;
 set GLOBAL query_cache_min_res_unit=default;
 set GLOBAL query_cache_size=default;
-# End of 5.0 tests
 
+# End of 5.0 tests

sql/sql_cache.cc

@@ -2991,7 +2991,8 @@ void Query_cache::double_linked_list_join(Query_cache_block *head_tail,
     >0  number of tables
 */
 
-static TABLE_COUNTER_TYPE process_and_count_tables(TABLE_LIST *tables_used,
+TABLE_COUNTER_TYPE
+Query_cache::process_and_count_tables(THD *thd, TABLE_LIST *tables_used,
                                       uint8 *tables_type)
 {
   DBUG_ENTER("process_and_count_tables");
@@ -2999,6 +3000,22 @@ static TABLE_COUNTER_TYPE process_and_count_tables(TABLE_LIST *tables_used,
   for (; tables_used; tables_used= tables_used->next_global)
   {
     table_count++;
+#ifdef HAVE_QUERY_CACHE
+    /*
+      Disable any attempt to store this statement if there are
+      column level grants on any referenced tables.
+      The grant.want_privileges flag was set to 1 in the
+      check_grant() function earlier if the TABLE_LIST object
+      had any associated column privileges.
+    */
+    if (tables_used->grant.want_privilege)
+    {
+      DBUG_PRINT("qcache", ("Don't cache statement as it refers to "
+                            "tables with column privileges."));
+      thd->lex->safe_to_cache_query= 0;
+      DBUG_RETURN(0);
+    }
+#endif
     if (tables_used->view)
     {
       DBUG_PRINT("qcache", ("view: %s  db: %s",
@@ -3071,7 +3088,8 @@ Query_cache::is_cacheable(THD *thd, uint32 query_len, char *query, LEX *lex,
                           (long) lex->select_lex.options,
                           (int) thd->variables.query_cache_type));
 
-    if (!(table_count= process_and_count_tables(tables_used, tables_type)))
+    if (!(table_count= process_and_count_tables(thd, tables_used,
+                                                tables_type)))
       DBUG_RETURN(0);
 
     if ((thd->options & (OPTION_NOT_AUTOCOMMIT | OPTION_BEGIN)) &&

sql/sql_cache.h

@@ -368,10 +368,12 @@ class Query_cache
     If query is cacheable return number tables in query
     (query without tables not cached)
   */
-  static
   TABLE_COUNTER_TYPE is_cacheable(THD *thd, uint32 query_len, char *query,
                                   LEX *lex, TABLE_LIST *tables_used,
                                   uint8 *tables_type);
+  TABLE_COUNTER_TYPE process_and_count_tables(THD *thd,
+                                              TABLE_LIST *tables_used,
+                                              uint8 *tables_type);
 
   static my_bool ask_handler_allowance(THD *thd, TABLE_LIST *tables_used);
  public: