The problem is that DROP TABLE and other DDL statements failed to
automatically close handlers associated with tables that were marked
for reopen (FLUSH TABLES).

The current implementation fails to properly discard handlers of
dropped tables (that were marked for reopen) because it searches
on the open handler tables list and using the current alias of the
table being dropped. The problem is that it must not use the open
handler tables list to search because the table might have been
closed (marked for reopen) by a flush tables command and also it
must not use the current table alias at all since multiple different
aliases may be associated with a single table. This is specially
visible when a user has two open handlers (using alias) of a same
table and a flush tables command is issued before the table is
dropped (see test case). Scanning the handler table list is also
useless for dropping handlers associated with temporary tables,
because temporary tables are not kept in the THD::handler_tables
list.

The solution is to simple scan the handlers hash table searching
for, and deleting all handlers with matching table names if the
reopen flag is not passed to the flush function, indicating that
the handlers should be deleted. All matching handlers are deleted
even if the associated the table is not open.


mysql-test/include/handler.inc:
  Add test case for Bug#31397
mysql-test/r/handler_innodb.result:
  Add test case result for Bug#31397
mysql-test/r/handler_myisam.result:
  Add test case result for Bug#31397
sql/mysql_priv.h:
  Rename flush functions to better match the intent of the caller and
  update functions prototypes and remove unused flags.
sql/sql_base.cc:
  Rename flush functions to better match the intent of the caller.
sql/sql_class.cc:
  Rename the flush functions to better match the intent of the caller.
  The hash_free function is moved to the cleanup.
sql/sql_handler.cc:
  When dropping tables for a final close, scan the handler's hash table since
  the table might not be in the handlers open table list because the table was
  marked for reopen or because it's a temporary table.
sql/sql_rename.cc:
  Drop handlers associated with tables that are being renamed.
sql/sql_table.cc:
  Now that temporary tables are properly removed even when opened
  by a SQL HANDLER, enable the assert since this branch can't be taken
  outside of SF/trigger/prelocked mode.

Post pushbuild fix

Disabled test on windows due to bug#30459
(DATA/INDEX DIR for partitions not working on windows)

Patch from Mattias Jonsson.


mysql-test/r/partition_mgm.result:
  Bug#32091: Security breach via directory changes
  
  fixed non-windows lines.
mysql-test/t/partition_mgm.test:
  Bug#32091: Security breach via directory changes
  
  fixed non-windows lines.
mysql-test/t/partition_symlink.test:
  Bug#32091: Security breach via directory changes
  
  Added no_windows, since it is affected of bug#30459

into  stella.local:/home2/mydev/mysql-5.1-bug31210


libmysqld/lib_sql.cc:
  Auto merged

            if running as root

Every start of a server in the test suite raised that warning.

The cause was an unconditionla add of the --user option to the
server command line. Only the "root" user (effective user id == 0)
must use that option.

Added check for effective user id == 0 before adding --user.

Thanks to Magnus Svensson for the patch.


mysql-test/mysql-test-run.pl:
  Bug#32078 - Excessive warnings: One can only use the --user switch
              if running as root
  Added check for effective user id == 0 before adding --user
  in mysqld_arguments().

into  mattiasj-laptop.(none):/home/mattiasj/clones/mysql-5.1-last_with_main

into  mattiasj-laptop.(none):/home/mattiasj/clones/mysql-5.1-last_with_main


libmysqld/lib_sql.cc:
  Auto merged
mysql-test/include/mix1.inc:
  Auto merged
mysql-test/r/innodb_mysql.result:
  Auto merged
sql/event_scheduler.cc:
  Auto merged
sql/events.cc:
  Auto merged
sql/ha_ndbcluster_binlog.cc:
  Auto merged
sql/handler.cc:
  Auto merged
sql/item_func.cc:
  Auto merged
sql/slave.cc:
  Auto merged
sql/sql_acl.cc:
  Auto merged
sql/sql_base.cc:
  Auto merged
sql/sql_connect.cc:
  Auto merged
sql/sql_insert.cc:
  Auto merged
sql/sql_lex.h:
  Auto merged
sql/sql_yacc.yy:
  Auto merged

into  mysql.com:/home/svoj/devel/mysql/BUG32111/mysql-5.1-engines


mysql-test/r/symlink.result:
  Auto merged
mysql-test/t/symlink.test:
  Auto merged

into  mysql.com:/home/svoj/devel/mysql/BUG32111/mysql-5.0-engines


mysql-test/r/symlink.result:
  Auto merged
mysql-test/t/symlink.test:
  Auto merged

  Use proper variable for test.


mysql-test/t/symlink.test:
  Use proper variable for test.
mysql-test/r/symlink.result:
  Use proper variable for test.

into  stella.local:/home2/mydev/mysql-5.1-bug31210

into  mattiasj-laptop.(none):/home/mattiasj/clones/mysql-5.1-lastfinaltopush

into  mattiasj-laptop.(none):/home/mattiasj/clones/mysql-5.1-lastfinaltopush


mysql-test/r/partition.result:
  Auto merged

into  mattiasj-laptop.(none):/home/mattiasj/clones/mysql-5.1-lastfinaltopush

into  mattiasj-laptop.(none):/home/mattiasj/clones/mysql-5.1-lastfinaltopush

Buffer overflow due to wrong key length in partitioning

Changed to the correct key_length function.


sql/opt_range.cc:
  Bug#31705 Partitions: crash if varchar length > 65530
  Problem: buffer overflow due to wrong key-length
  
  Fix: Using correct key_length function
mysql-test/r/partition_datatype.result:
  Bug#31705 Partitions: crash if varchar length > 65530
  New test-result case for testing all column types
  used in key-partitioning.
  
  (For verifying correct key-length use)
mysql-test/t/partition_datatype.test:
  Bug#31705 Partitions: crash if varchar length > 65530 
  New test case for testing all column types
  used in key-partitioning.
  
  (For verifying correct key-length used)

Merge fix

partition_mgm did not require have_symlink.

Moved the test case to partition_symlink, which
require have_symlink, and should work on both *nix and
Windows


mysql-test/r/partition_mgm.result:
  Bug#32091: Security breach via directory changes
  
  Moved the test case to partition_symlink.
mysql-test/t/partition_mgm.test:
  Bug#32091: Security breach via directory changes
  
  Moved the test case to partition_symlink.
mysql-test/r/partition_symlink.result:
  Bug#32091: Security breach via directory changes
  
  Moved the test case to partition_symlink. It requires
  have_symlink.
mysql-test/t/partition_symlink.test:
  Bug#32091: Security breach via directory changes
  
  Moved the test case to partition_symlink. It requires
  have_symlink.

                partitioned table
    
Post-pushbuild fix
    
Pushbuild detected yet another need for lex initialization in
embedded server.


libmysqld/lib_sql.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
                      partitioned table
  Initialized lex for later use in open_table().

into  mysql.com:/home/svoj/devel/mysql/BUG32111/mysql-5.1-engines


mysql-test/r/symlink.result:
  Auto merged
mysql-test/t/symlink.test:
  Auto merged
mysys/my_symlink2.c:
  Auto merged

into  mysql.com:/home/svoj/devel/mysql/BUG32111/mysql-5.0-engines


mysql-test/r/symlink.result:
  Auto merged
mysql-test/t/symlink.test:
  Auto merged
mysys/my_symlink2.c:
  Auto merged

into  mysql.com:/home/svoj/devel/mysql/BUG32111/mysql-4.1-engines


mysys/my_symlink2.c:
  Auto merged
mysql-test/r/symlink.result:
  SCCS merged
mysql-test/t/symlink.test:
  SCCS merged

Adding missing drop of user created for test case.


mysql-test/r/mysqlbinlog.result:
  Result file change.
mysql-test/t/mysqlbinlog.test:
  Dropping user that was added earlier in the test.

    causes the Server to crash.

Post-pushbuild fix

Pushbuild genereted valgrind warnings.

Changed function to safer variant.


sql/sql_partition.cc:
  Bug#30695: An apostrophe ' in the comment of the ADD PARTITION
      causes the Server to crash.
  
  Fix for valgrind warning in pushbuild.
  String.c_prt fcn is not as safe as comment says.
  (gives valgrind errors in this case)

              partitioned table
  
Post-pushbuild fix
  
Pushbuild detected a new need for lex initialization in
embedded server.

Fixed test for INSERT DELAYED in partitions_hash.test so that
it works with embedded server.


libmysqld/lib_sql.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
                  partitioned table
  Initialized lex for later use in open_table().
mysql-test/r/partition_hash.result:
  Bug#31210 - INSERT DELAYED crashes server when used on
                  partitioned table
  Fixed test result for embedded server.
mysql-test/t/partition_hash.test:
  Bug#31210 - INSERT DELAYED crashes server when used on
                  partitioned table
  Fixed test for embedded server.

Changed test case from GRANT to CREATE USER


mysql-test/r/partition_mgm.result:
  Bug#32091: Security breach via directory changes
  test result
mysql-test/t/partition_mgm.test:
  Bug#32091: Security breach via directory changes
  Changed test case from GRANT to CREATE USER

small fix of test case (when running make test after
merge, it did not substitute MYSQLTEST_VARDIR in
the error)


mysql-test/r/partition_mgm.result:
  Bug#32091: Security breach via directory changes
  small fix in test result
mysql-test/t/partition_mgm.test:
  Bug#32091: Security breach via directory changes
  small fix in test case

            partitioned table

Post-merge fix

A new need for lex initialization arose.


sql/ha_ndbcluster.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().

Problem: there was no standard syntax error when
         creating partitions with syntax error in
         the partitioning clause.

Solution: added "Syntax error: " to the error message


mysql-test/r/partition.result:
  Bug#29368: Incorrect error for syntax error when createing
             partition
  
  test result update
mysql-test/r/partition_error.result:
  Bug#29368: Incorrect error for syntax error when createing
             partition
  
  test result
mysql-test/t/partition_error.test:
  Bug#29368: Incorrect error for syntax error when createing
             partition
  
  test case
sql/share/errmsg.txt:
  Bug#29368: Incorrect error for syntax error when createing
             partition
  
  Modified error messages

into  stella.local:/home2/mydev/mysql-5.1-bug31210


sql/sql_acl.cc:
  Auto merged
sql/sql_base.cc:
  Auto merged
sql/sql_connect.cc:
  Auto merged
sql/sql_insert.cc:
  Auto merged
sql/sql_lex.cc:
  Auto merged
sql/sql_lex.h:
  Auto merged
sql/sql_servers.cc:
  Auto merged
sql/sql_udf.cc:
  Auto merged
sql/table.cc:
  Auto merged

Problem: the table's INDEX and DATA DIR was taken
  directly from the table's first partition.
  This allowed rename attack similar to
  bug#32111 when ALTER TABLE REMOVE PARTITIONING

Solution: Silently ignore the INDEX/DATA DIR
  for the table. (Like some other storage engines
  do). 
  Partitioned tables do not support DATA/INDEX
  DIR on the table level, only on its partitions.


mysql-test/r/partition_mgm.result:
  Bug#32091: Security breach via directory changes
  test result
mysql-test/t/partition_mgm.test:
  Bug#32091: Security breach via directory changes
  test case
sql/ha_partition.cc:
  Bug#32091: Security breach via directory changes
  
  Do not use the first partition's DATA/INDEX DIR
  as the table's DATA/INDEX DIR.
  (A partitioned table do not have support for DATA/
  INDEX DIR, only its partitions do)

into  stella.local:/home2/mydev/mysql-5.1-bug22351


sql/handler.cc:
  Auto merged

into  kindahl-laptop.dnsalias.net:/home/bk/b31611-mysql-5.1-target-5.1.22


sql/sql_binlog.cc:
  Auto merged

into  pcg5ppc.xiphis.org:/Network/Servers/anubis.xiphis.org/home/antony/work/p1-bug30671.3.merge-5.1

            the wrong buffer

handler::index_next_same() did not take into account that the
internally called function key_cmp_if_same() uses the fixed
buffer table->record[0] for key comparison instead of the
buffer provided by the caller of handler::index_next_same().

Added code to temporarily redirect table->record[0] and the fields
used for the key to the record buffer provided by the caller of
handler::index_next_same().

The test case is in partition.test already.


sql/handler.cc:
  Bug#22351 - handler::index_next_same() call to key_cmp_if_same() uses
              the wrong buffer
  Added code to temporarily redirect table->record[0] and the fields
  used for the key to the record buffer provided by the caller of
  handler::index_next_same().

into  lambda.hsd1.co.comcast.net.:/home/malff/TREE/mysql-5.1-runtime

RENAME TABLE against a table with DATA/INDEX DIRECTORY overwrites
the file to which the symlink points.

This is security issue, because it is possible to create a table with
some name in some non-system database and set DATA/INDEX DIRECTORY
to mysql system database. Renaming this table to one of mysql system
tables (e.g. user, host) would overwrite the system table.

Return an error when the file to which the symlink points exist.


mysql-test/r/symlink.result:
  A test case for BUG#32111.
mysql-test/t/symlink.test:
  A test case for BUG#32111.
mysys/my_symlink2.c:
  Return an error when the file to which the symlink points exist.

Post-merge fix. Moved test into 5.0 section.

into  stella.local:/home2/mydev/mysql-5.1-axmrg


mysql-test/t/ctype_uca.test:
  Auto merged
mysql-test/r/myisam.result:
  Manual merge from 5.0.
mysql-test/t/myisam.test:
  Manual merge from 5.0.
mysql-test/t/subselect.test:
  Manual merge from 5.0.
storage/myisam/mi_check.c:
  Manual merge from 5.0.

into  magare.gmz:/home/kgeorge/mysql/autopush/B31974-5.1-runtime

into  stella.local:/home2/mydev/mysql-5.1-axmrg