1. 18 Dec, 2012 6 commits
    • Vasil Dimov's avatar
      Merge mysql-5.1 -> mysql-5.5 · 3863f513
      Vasil Dimov authored
      3863f513
    • Vasil Dimov's avatar
      Fix Bug#16000909 MEMORY LEAK, MYSQL_INPLACE_ALTER_TABLE · 036079fb
      Vasil Dimov authored
      This is a followup to the fix of
      Bug#14628410 ASSERTION `! IS_SET()' FAILED IN DIAGNOSTICS_AREA::SET_OK_STATUS
      (satya.bodapati@oracle.com-20121213132316-5joz4phltx9yhjs7)
      
      In innobase_mysql_tmpfile(): allocate/open the file after
      the return(-1); statement.
      036079fb
    • Ahmad Abdullateef's avatar
      BUG#14727815 - CRASH IN PTHREAD_RWLOCK_WRLOCK/SRW_UNLOCK · 7519cfff
      Ahmad Abdullateef authored
                                   IN QUERY CACHE CODE
      
      DESCRIPTION:
      MySQL Server crashes sporadically when Query Caching is on and
      the server has high contention among clients. 
      
      
      ANALYSIS :
      
      Scenario 1:
      In Query_cache::move_by_type() when handling RESULT or its related blocks,
      Write Lock is acquired on its parent Query block. However the next and prev
      pointers are cached in local variables before lock acquisition. In an extremely
      high contention scenario there exists a possibility that
      Query_cache::append_result_data() is operating on the same query block
      and as a consequence might append a new Result block to the end of Result
      blocks Linked List of the Query. This would manipulate the next, prev pointers
      of the Block being processed in move_by_type(), however the local pointers
      still point to previous nodes there by causing Data Corruption leading to crash.
      
      Scenario 2:
      In Windows SDK "BOOL" is typedefed as "int" and BOOLEAN is typedefed as
      "usigned char". The function pointer definition "srw_bool_func" mistakenly uses 
      BOOL instead of BOOLEAN thereby virtually making the function 
      my_TryAcquireSRWLockExclusive() always succeed because only the LSB of EAX
      has the actual result of the call, however due to type mismatch all bytes of EAX
      are used for evaluation. Again during high contention scenarios in 
      Query_cache::free_old_query() calls try_lock_writing() on a Query, this call 
      always succeeds and the query is freed, even though it is used by some other
      thread, in this case Query_cache::send_result_to_client() was using it and the
      code causes a crash because it accessed free or reallocated memory.
      
      FIX :
      
      Scenario 1:
      The next, prev pointers are now accessed only after Lock acquisition in 
      Query_cache::move_by_type().
      
      Scenario 2:
      In the definition of "srw_bool_func" BOOL has been replaced with "BOOLEAN"
      7519cfff
    • Ahmad Abdullateef's avatar
      BUG#14727815 - CRASH IN PTHREAD_RWLOCK_WRLOCK/SRW_UNLOCK · e4a2755f
      Ahmad Abdullateef authored
                                   IN QUERY CACHE CODE
      
      DESCRIPTION:
      MySQL Server crashes sporadically when Query Caching is on and
      the server has high contention among clients. 
      
      
      ANALYSIS :
      
      Scenario 1:
      In Query_cache::move_by_type() when handling RESULT or its related blocks,
      Write Lock is acquired on its parent Query block. However the next and prev
      pointers are cached in local variables before lock acquisition. In an extremely
      high contention scenario there exists a possibility that
      Query_cache::append_result_data() is operating on the same query block
      and as a consequence might append a new Result block to the end of Result
      blocks Linked List of the Query. This would manipulate the next, prev pointers
      of the Block being processed in move_by_type(), however the local pointers
      still point to previous nodes there by causing Data Corruption leading to crash.
      
      FIX :
      
      Scenario 1:
      The next, prev pointers are now accessed only after Lock acquisition in 
      Query_cache::move_by_type().
      e4a2755f
    • Vasil Dimov's avatar
      Merge mysql-5.1 -> mysql-5.5 · a68a8655
      Vasil Dimov authored
      a68a8655
    • Vasil Dimov's avatar
      Fix Bug#13463493 INNODB PLUGIN WERE CHANGED, BUT STILL USE THE · 0273c0d0
      Vasil Dimov authored
      SAME VERSION NUMBER 1.0.17
      
      Now that InnoDB/InnoDB Plugin is no longer separately developed and
      distributed from the MySQL server it does not need its own version number.
      Thus use the MySQL version instead.
      
      "Removing" the version altogether is not feasible because the config
      variable 'innodb_version' cannot be removed in GA branches.
      
      Reviewed by:	Marko (rb#1751)
      0273c0d0
  2. 14 Dec, 2012 2 commits
  3. 13 Dec, 2012 3 commits
    • Ravinder Thakur's avatar
      bug#11761752: DO NOT ALLOW USE OF ALTERNATE DATA STREAMS ON NTFS FILESYSTEM. · d02ae461
      Ravinder Thakur authored
      File names with colon are being disallowed because of the Alternate Data 
      Stream (ADS) feature of NTFS that could be misused. ADS allows data to be 
      written to alternate streams of a normal file. The data in alternate 
      streams cannot be seen by normal tools on Windows (explorer, cmd.exe). As 
      a result someone can use this feature to hide large amount of data in 
      alternate streams and admins will have no easy way of figuring out the 
      files that are using that disk space. The fix also disallows ADS in the 
      scenarios where file name is passed as some dynamic variable.
      
      An important thing about the fix is that it DOES NOT disallow ADS file 
      names if they are not dynamic (i.e. if the file is created by using some 
      option that needs local access to the MySQL server, for example error log
      file). The reasoning is that if some MySQL option related to files 
      requires access to the local machine (it is not dynamic), then user can very 
      well create data in ADS by some other means. This fixes only those scenarios 
      which can allow users to create data in ADS over the wire.
      
      File names with colon are being disallowed only on Windows. UNIX 
      (Linux in particular) supports NTFS, but it will not be a common 
      scenario for someone to configure a NTFS file system to store MySQL 
      data on Linux.
      
      Changes in file bug11761752-master.opt are needed due to 
      bug number 15937938.
      d02ae461
    • Satya Bodapati's avatar
      Bug#14628410 - ASSERTION `! IS_SET()' FAILED IN DIAGNOSTICS_AREA::SET_OK_STATUS · a83d1098
      Satya Bodapati authored
      The error code returned from Merge file/Temp file creation functions are
      ignored.
      
      Use the return codes of the row_merge_file_create() and innobase_mysql_tmpfile()
      to return the error to caller if file creation fails.
      
      Approved by Marko. rb#1618
      a83d1098
    • Harin Vadodaria's avatar
      Bug#15965288: BUFFER OVERFLOW IN YASSL FUNCTION · 82aa3857
      Harin Vadodaria authored
                    DOPROCESSREPLY()
      
      Description: Function DoProcessReply() calls function
                   decrypt_message() in a while loop without
                   performing a check on available buffer
                   space. This can cause buffer overflow and
                   crash the server. This patch is fix provided
                   by Sawtooth to resolve the issue.
      82aa3857
  4. 12 Dec, 2012 1 commit
  5. 11 Dec, 2012 3 commits
    • Dmitry Lenev's avatar
      Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE · a162adad
      Dmitry Lenev authored
      ROBUST AGAINST BUGS IN CALLERS".
      
      Both MDL subsystems and Table Definition Cache code assume 
      that callers ensure that names of objects passed to them are 
      not longer than NAME_LEN bytes. Unfortunately due to bugs in 
      callers this assumption might be broken in some cases. As
      result we get nasty bugs causing buffer overruns when we
      construct MDL key or TDC key from object names.
      
      This patch makes TDC code more robust against such bugs by 
      ensuring that we always checking size of result buffer when
      constructing TDC keys. This doesn't free its callers from 
      ensuring that both db and table names are shorter than 
      NAME_LEN bytes. But at least this steps prevents buffer 
      overruns in case of bug in caller, replacing them with less 
      harmful behavior.
      
      This is 5.1-only version of patch.
      
      This patch introduces new version of create_table_def_key()
      helper function which constructs TDC key without risk of
      result buffer overrun. Places in code that construct TDC keys 
      were changed to use this function.
      
      Also changed rm_temporary_table() and open_new_frm() functions
      to avoid use of "unsafe" strmov() and strxmov() functions and 
      use safer strnxmov() instead.
      a162adad
    • unknown's avatar
    • Annamalai Gurusami's avatar
      Bug #14200010 NEWLY CREATED TABLE DOESN'T ALLOW FOR LOOSE INDEX SCANS · 92ad6f56
      Annamalai Gurusami authored
      Problem:
      
      Before the ALTER TABLE statement, the array
      dict_index_t::stat_n_diff_key_vals had proper values calculated
      and updated.  But after the ALTER TABLE statement, all the values
      of this array is 0.  
      
      Because of this statistics returned by innodb_rec_per_key() is
      different before and after the ALTER TABLE statement. Running the
      ANALYZE TABLE command populates the statistics correctly.
      
      Solution:
      
      After ALTER TABLE statement, set the flag dict_table_t::stat_initialized
      correctly so that the table statistics will be recalculated properly when
      the table is next loaded.  But note that we still don't choose the loose
      index scans.  This fix only ensures that an ALTER TABLE does not change
      the optimizer plan.
      
      rb://1639 approved by Marko and Jimmy.
      92ad6f56
  6. 10 Dec, 2012 1 commit
  7. 17 Dec, 2012 1 commit
  8. 14 Dec, 2012 2 commits
  9. 13 Dec, 2012 4 commits
  10. 12 Dec, 2012 2 commits
    • Nirbhay Choubey's avatar
      Bug#13639125 DELIMITER STRIPS THE NEXT NEW LINE · 5f915465
      Nirbhay Choubey authored
                   IN A SQL STATEMENT
      
      While processing each lines entered at the prompt,
      mysql client appends a '\n' to all the lines except
      for delimiter commands. However the same logic must
      not apply if 'delimiter' is part of a string or a
      comment, for which a '\n' should be added.
      
      Fixed by adding appropriate checks.
      
      Added a test case.
      
      5f915465
    • unknown's avatar
      upmerge 14737171 5.1=>5.5 · 0095bd00
      unknown authored
      0095bd00
  11. 11 Dec, 2012 4 commits
    • Dmitry Lenev's avatar
      Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE · 07ebc468
      Dmitry Lenev authored
      ROBUST AGAINST BUGS IN CALLERS".
      
      Both MDL subsystems and Table Definition Cache code assume
      that callers ensure that names of objects passed to them are
      not longer than NAME_LEN bytes. Unfortunately due to bugs in
      callers this assumption might be broken in some cases. As
      result we get nasty bugs causing buffer overruns when we
      construct MDL key or TDC key from object names.
      
      This patch makes MDL and TDC code more robust against such
      bugs by ensuring that we always checking size of result
      buffer when constructing MDL and TDC keys. This doesn't
      free its callers from ensuring that both db and table names
      are shorter than NAME_LEN bytes. But at least these steps
      prevents buffer overruns in case of bug in caller, replacing
      them with less harmful behavior.
      
      This is 5.5-only version of patch.
      
      Changed code of MDL_key::mdl_key_init() to take into account
      size of buffer for the key.
      
      Introduced new version of create_table_def_key() helper function
      which constructs TDC key without risk of result buffer overrun.
      Places in code that construct TDC keys were changed to use this
      function.
      
      Also changed rm_temporary_table() and open_new_frm() functions
      to avoid use of "unsafe" strmov() and strxmov() functions and
      use safer strnxmov() instead.
      07ebc468
    • unknown's avatar
      upmerge 14737171 5.1 => 5.5 · a512203c
      unknown authored
      a512203c
    • Joerg Bruehe's avatar
      Merge ULN RPM stuff to main branch. · 58677aef
      Joerg Bruehe authored
      58677aef
    • Annamalai Gurusami's avatar
      4e564146
  12. 10 Dec, 2012 1 commit
    • Joerg Bruehe's avatar
      RPMs for ULN do not build in MySQL 5.6: Patches + libmysqld.so · fec7eeea
      Joerg Bruehe authored
      Bug #15972480
      
      This is the change for 5.5:
          a cleanup in the way "libmysqld.so" is created.
      (Patches were adapted for 5.5 previously.)
      
      Originally, the ".so" was created by taking all modules in
      "libmysqld.a", after removing some few which caused unresolved
      references.
      This is no good idea, rather "ld" should be used to follow all
      references from some few start modules.
      
      At the same time, the ".so" version needed to be corrected:
      The original "0.0.1" is both wrong and risky.
      Rather, the server version is used to identify the ".so" file,
      but for linkage the first two levels are sufficient (so upgrades
      are possible without re-building the embedded application).
      fec7eeea
  13. 09 Dec, 2012 3 commits
    • Shivji Kumar Jha's avatar
      BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE RPL_ROW_UNTIL TIMES OUT · 64aad461
      Shivji Kumar Jha authored
                   
                   patch to fix post push falures in pb2
                   bzr merge 5.1->5.5
      
      BUG#15872504 - REMOVE MYSQL-TEST/INCLUDE/GET_BINLOG_DUMP_THREAD_ID.INC
                   bzr merge 5.1->5.6
      64aad461
    • Shivji Kumar Jha's avatar
      BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE PL_ROW_UNTIL TIMES OUT · 453f88f0
      Shivji Kumar Jha authored
             
             patch to fix post push falures in pb2 
      
      BUG#15872504 - REMOVE MYSQL-TEST/INCLUDE/GET_BINLOG_DUMP_THREAD_ID.INC
                  
      === Problem ===
                  
      The file named "mysql-test/include/get_binlog_dump_thread_id.inc" is not 
      used anywhere. In any case, this file does wrong things in the wrong way:
      1) The file seems to assume there is only one dump thread, but there may 
         be many.
      2) you can get this information in a much easier way using the command:
         "select thread_id from threads where processlist_command="Binlog Dump";"
      
      === Fix ===
                
      removed file 'mysql-test/include/get_binlog_dump_thread_id.inc'
      453f88f0
    • Shivji Kumar Jha's avatar
      BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE · fb21e070
      Shivji Kumar Jha authored
                     RPL_ROW_UNTIL TIMES OUT
       
       patch to fix post push falures in pb2 
      
      mysql-test/suite/rpl/r/rpl_row_until.result:
        changes to account for the changes made in
        corresponding test file.
      mysql-test/suite/rpl/t/disabled.def:
        disabled test in macosx
      mysql-test/suite/rpl/t/rpl_row_until.test:
        replaced static relayy log file by an mtr variable
        which saves the name of relay log file.
      fb21e070
  14. 07 Dec, 2012 2 commits
  15. 06 Dec, 2012 2 commits
    • Harin Vadodaria's avatar
      Bug#15912213: BUFFER OVERFLOW IN ACL_GET() · eb242c80
      Harin Vadodaria authored
                  
      Description: A very large database name causes buffer
                   overflow in functions acl_get() and
                   check_grant_db() in sql_acl.cc. It happens
                   due to an unguarded string copy operation.
                   This puts required sanity checks before
                   copying db string to destination buffer.
      eb242c80
    • Dmitry Shulga's avatar
      This patch fixes bug#14729757 - MY_HASH_SEARCH(&XID_CACHE, · 49c1d13f
      Dmitry Shulga authored
                                      XID_STATE->XID.KEY(),
                                      XID_STATE->XID.KEY_LENGTH())==0
        
      This bug is a regression of bug#11759534 - 51855: RACE CONDITION
                                                 IN XA START.
        
      The reason for regression is that the changes that fixes the original
      bug wasn't merged from mysql-5.1 into mysql-5.5 and mysql-trunk.
      Only null-merge was done for the patch changeset.
        
      To incorporate lost changes the manual merge have been done.
        
      Additionally the call of trans_rolback() was added into trans_xa_start()
      in case if xid_cache_insert is failed() after transaction has been started.
      If we don't call trans_rollback() we would never reset the flag
      SERVER_STATUS_IN_TRANS in THD::server_status and therefore all subsequent
      attempts to execute XA START in the connection where the error was occurred
      will be failed since thd->in_active_multi_stmt_transaction() will return
      the true every time when trans_xa_start is called.
        
      The latest changes were absent in patch for mysql-5.1
      49c1d13f
  16. 05 Dec, 2012 3 commits