Queries may crash, if
  1) the GREATEST or the LEAST function has a mixed list of
     numeric and LONGBLOB arguments and
  2) the result of such a function goes through an intermediate
     temporary table.

An Item that references a LONGBLOB field has max_length of
UINT_MAX32 == (2^32 - 1).

The current implementation of GREATEST/LEAST returns REAL
result for a mixed list of numeric and string arguments (that
contradicts with the current documentation, this contradiction
was discussed and it was decided to update the documentation).

The max_length of such a function call was calculated as a
maximum of argument max_length values (i.e. UINT_MAX32).

That max_length value of UINT_MAX32 was used as a length for
the intermediate temporary table Field_double to hold
GREATEST/LEAST function result.

The Field_double::val_str() method call on that field
allocates a String value.

Since an allocation of String reserves an additional byte
for a zero-termination, the size of String buffer was
set to (UINT_MAX32 + 1), that caused an integer overflow:
actually, an empty buffer of size 0 was allocated.

An initialization of the "first" byte of that zero-size
buffer with '\0' caused a crash.

The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.


******
Bug #54461: crash with longblob and union or update with subquery

Queries may crash, if
  1) the GREATEST or the LEAST function has a mixed list of
     numeric and LONGBLOB arguments and
  2) the result of such a function goes through an intermediate
     temporary table.

An Item that references a LONGBLOB field has max_length of
UINT_MAX32 == (2^32 - 1).

The current implementation of GREATEST/LEAST returns REAL
result for a mixed list of numeric and string arguments (that
contradicts with the current documentation, this contradiction
was discussed and it was decided to update the documentation).

The max_length of such a function call was calculated as a
maximum of argument max_length values (i.e. UINT_MAX32).

That max_length value of UINT_MAX32 was used as a length for
the intermediate temporary table Field_double to hold
GREATEST/LEAST function result.

The Field_double::val_str() method call on that field
allocates a String value.

Since an allocation of String reserves an additional byte
for a zero-termination, the size of String buffer was
set to (UINT_MAX32 + 1), that caused an integer overflow:
actually, an empty buffer of size 0 was allocated.

An initialization of the "first" byte of that zero-size
buffer with '\0' caused a crash.

The Item_func_min_max::fix_length_and_dec() has been
modified to calculate max_length for the REAL result like
we do it for arithmetical operators.



mysql-test/r/func_misc.result:
  Test case for bug #54461.
  
  ******
  Test case for bug #54461.
mysql-test/t/func_misc.test:
  Test case for bug #54461.
  
  ******
  Test case for bug #54461.
sql/item_func.cc:
  Bug #54461: crash with longblob and union or update with subquery
  
  The Item_func_min_max::fix_length_and_dec() has been
  modified to calculate max_length for the REAL result like
  we do it for arithmetical operators.
  
  ******
  Bug #54461: crash with longblob and union or update with subquery
  
  The Item_func_min_max::fix_length_and_dec() has been
  modified to calculate max_length for the REAL result like
  we do it for arithmetical operators.

Fix compiler warnings.

mysys/stacktrace.c:
  Tag unused parameters.
sql/sql_lex.cc:
  Variable becomes unused in non-debug builds. Also, no need to
  assert the obvious.

mostly because existing test result files were not updated.

In order to be able to check if the set of the grouping fields in a 
GROUP BY has changed (and thus to start a new group) the optimizer
caches the current values of these fields in a set of Cached_item 
derived objects.
The Cached_item_str, used for caching varchar and TEXT columns,
is limited in length by the max_sort_length variable.
A String buffer to store the value with an alloced length of either
the max length of the string or the value of max_sort_length 
(whichever is smaller) in Cached_item_str's constructor.
Then, at compare time the value of the string to compare to was 
truncated to the alloced length of the string buffer inside 
Cached_item_str.
This is all fine and valid, but only if you're not assigning 
values near or equal to the alloced length of this buffer.
Because when assigning values like this the alloced length is 
rounded up and as a result the next set of data will not match the
group buffer, thus leading to wrong results because of the changed
alloced_length.
Fixed by preserving the original maximum length in the 
Cached_item_str's constructor and using this instead of the 
alloced_length to limit the string to compare to.
Test case added.

Fix a regression (due to a typo) which caused spurious incorrect
argument errors for long data stream parameters if all forms of
logging were disabled (binary, general and slow logs).

sql/sql_prepare.cc:
  Add a missing logical NOT operator.

Fix a regression (due to a typo) which caused spurious incorrect
argument errors for long data stream parameters if all forms of
logging were disabled (binary, general and slow logs).

mysql-test/t/mysql_client_test.test:
  Save the status of the slow_log.
sql/sql_prepare.cc:
  Add a missing logical NOT operator.
tests/mysql_client_test.c:
  Disable all query logs when running C tests. Fixes a omission
  when, slow log should have been disabled too.
  
  Run test case for Bug#54041 with query logs enabled and disabled.

With statement- or mixed-mode logging, "LOAD DATA INFILE" queries
are written to the binlog using special types of log events.
When mysqlbinlog reads such events, it re-creates the file in a
temporary directory with a generated filename and outputs a
"LOAD DATA INFILE" query where the filename is replaced by the
generated file. The temporary file is not deleted by mysqlbinlog
after termination.

To fix the problem, in mixed mode we go to row-based. In SBR, we
document it to remind user the tmpfile is left in a temporary
directory.


mysql-test/suite/binlog/r/binlog_mixed_load_data.result:
  Test result for BUG#34283.
mysql-test/suite/binlog/t/binlog_mixed_load_data.test:
  Added the test file to verify that 'load data infile...' statement
  will go to row-based in mixed mode.
sql/sql_load.cc:
  Added code to go to row-based in mixed mode for
  'load data infile ...' statement

The problem is that the fix Bug#29784 was mistakenly
reverted when updating YaSSL to a newer version.

The solution is to re-apply the fix and this time
actually add a meaningful test case so that possible
regressions are caught.

extra/yassl/taocrypt/src/coding.cpp:
  Fixed buffer allocation to compute the proper maximum
  decoded size: (EncodedLength * 3/4) + 3
mysql-test/std_data/server8k-cert.pem:
  Update certificate.
mysql-test/std_data/server8k-key.pem:
  Update key.
mysql-test/t/ssl_8k_key-master.opt:
  Start the server using the certificate and key that
  triggers the problem.

Problem: The original patch didn't compile on debug_werror
due to wrong format in printf("%d") for size_t variables.

Fix: Adding cast to (int).

/*![:version:] Query Code */, where [:version:] is a sequence of 5 
digits representing the mysql server version(e.g /*!50200 ... */),
is a special comment that the query in it can be executed on those 
servers whose versions are larger than the version appearing in the 
comment. It leads to a security issue when slave's version is larger 
than master's. A malicious user can improve his privileges on slaves. 
Because slave SQL thread is running with SUPER privileges, so it can
execute queries that he/she does not have privileges on master.

This bug is fixed with the logic below: 
- To replace '!' with ' ' in the magic comments which are not applied on
  master. So they become common comments and will not be applied on slave.

- Example:
  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
  will be binlogged as
  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/

mysql-test/suite/rpl/t/rpl_conditional_comments.test:
  Test the patch for this bug.
sql/mysql_priv.h:
  Rename inBuf as rawBuf and remove the const limitation.
sql/sql_lex.cc:
  To replace '!' with ' ' in the magic comments which are not applied on
  master.
sql/sql_lex.h:
  Remove the const limitation on parameter buff, as it can be modified in the function since
  this patch.
  Add member function yyUnput for Lex_input_stream. It set a character back the query buff.
sql/sql_parse.cc:
  Rename inBuf as rawBuf and remove the const limitation.
sql/sql_partition.cc:
  Remove the const limitation on parameter part_buff, as it can be modified in the function since
  this patch.
sql/sql_partition.h:
  Remove the const limitation on parameter part_buff, as it can be modified in the function since
  this patch.
sql/table.h:
  Remove the const limitation on variable partition_info, as it can be modified since
  this patch.

to mysql-5.1-innodb plugin.

Do not attempt to test the innodb plugin with the embedded server,
it's not supported for now.

Problem: The functions my_like_range_xxx() returned
badly formed maximum strings for Asian character sets,
which made problems for storage engines.

Fix: 
- Removed a number my_like_range_xxx() implementations,
  which were in fact dumplicate code pieces.
- Using generic my_like_range_mb() instead.
- Setting max_sort_char member properly for Asian character sets
- Adding unittest/strings/strings-t.c, 
  to test that my_like_range_xxx() return well-formed 
  min and max strings.

Notes:

- No additional tests in mysql/t/ available.
  Old tests cover the affected code well enough.

InnoDB Plugin 1.0.10 has been released with MySQL 5.1.49.

                     prepared statements

Using GROUP_CONCAT() together with the WITH ROLLUP modifier
could crash the server.

The reason was a combination of several facts:

1. The Item_func_group_concat class stores pointers to ORDER
objects representing the columns in the ORDER BY clause of
GROUP_CONCAT().

2. find_order_in_list() called from
Item_func_group_concat::setup() modifies the ORDER objects so
that their 'item' member points to the arguments list
allocated in the Item_func_group_concat constructor.

3. In some cases (e.g. in JOIN::rollup_make_fields) a copy of
the original Item_func_group_concat object could be created by
using the Item_func_group_concat::Item_func_group_concat(THD
*thd, Item_func_group_concat *item) copy constructor. The
latter essentially creates a shallow copy of the source
object. Memory for the arguments array is allocated on
thd->mem_root, but the pointers for arguments and ORDER are
copied verbatim.

What happens in the test case is that when executing the query
for the first time, after a copy of the original
Item_func_group_concat object has been created by
JOIN::rollup_make_fields(), find_order_in_list() is called for
this new object. It then resolves ORDER BY by modifying the
ORDER objects so that they point to elements of the arguments
array which is local to the cloned object. When thd->mem_root
is freed upon completing the execution, pointers in the ORDER
objects become invalid. Those ORDER objects, however, are also
shared with the original Item_func_group_concat object which is
preserved between executions of a prepared statement. So the
first call to find_order_in_list() for the original object on
the second execution tries to dereference an invalid pointer.

The solution is to create copies of the ORDER objects when
copying Item_func_group_concat to not leave any stale pointers
in other instances with different lifecycles.



mysql-test/r/func_gconcat.result:
  Test case for bug #54476.
mysql-test/t/func_gconcat.test:
  Test case for bug #54476.
sql/item_sum.cc:
  Copy the ORDER objects pointed to by the elements of the 
  'order' array in the copy constructor of 
  Item_func_group_concat.
sql/table.h:
  Removed the unused 'item_copy' member of the ORDER class.

Bug#49542 - Do as the comment suggests and downgrade directory errors from find_file() to a warning unless they happen during a SHOW command.

SHOW DATABASES LIKE ... was not converting to lowercase on comparison as the
documentation is suggesting. 
Fixed it to behave similarly to SHOW TABLES LIKE ... and updated the failing
on MacOSX lowercase_table2 test case.

to write into a closed socket

sql/protocol.cc:
  Protocol::flush modified: set thd->main_da.can_overwrite_status= TRUE
  before call to net_flush() in order to prevent crash on assert in case
  of socket write failure, reset it to FALSE when net_flush() returned;
  Protocol::send_fields modified: return from method with error if call to
  my_net_write(), proto.write() or write_eof_packet() failed.
sql/sql_cache.cc:
  Query_cache::send_result_to_client modified: call to
  thd->main_da.disable_status() only if write to socket
  was successful.
sql/sql_cursor.cc:
  Materialized_cursor::fetch modified: leave method if call to
  result->send_data() failed.
sql/sql_prepare.cc:
  send_prep_stmt() modified: call to thd->main_da.disable_status()
  only if thd->protocol_text.send_fields() completed successfully.

Fix warnings flagged by the new warning option -Wunused-but-set-variable
that was added to GCC 4.6 and that is enabled by -Wunused and -Wall. The
option causes a warning whenever a local variable is assigned to but is
later unused. It also warns about meaningless pointer dereferences.

client/mysql.cc:
  Meaningless pointer dereferences.
client/mysql_upgrade.c:
  Check whether reading from the file succeeded.
extra/comp_err.c:
  Unused.
extra/yassl/src/yassl_imp.cpp:
  Skip instead of reading data that is discarded.
include/my_pthread.h:
  Variable is only used in debug builds.
include/mysys_err.h:
  Add new error messages.
mysys/errors.c:
  Add new error message for permission related functions.
mysys/mf_iocache.c:
  Variable is only checked under THREAD.
mysys/my_copy.c:
  Raise a error if chmod or chown fails.
mysys/my_redel.c:
  Raise a error if chmod or chown fails.
regex/engine.c:
  Use a equivalent variable for the assert.
server-tools/instance-manager/instance_options.cc:
  Unused.
sql/field.cc:
  Unused.
sql/item.cc:
  Unused.
sql/log.cc:
  Do not ignore the return value of freopen: only set buffer if
  reopening succeeds.
  
  Adjust doxygen comment to the right function.
  
  Pass message lenght to log function.
sql/mysqld.cc:
  Do not ignore the return value of freopen: only set buffer if
  reopening succeeds.
sql/partition_info.cc:
  Unused.
sql/slave.cc:
  No need to set pointer to the address of '\0'.
sql/spatial.cc:
  Unused. Left for historical purposes.
sql/sql_acl.cc:
  Unused.
sql/sql_base.cc:
  Pointers are always set to the same variables.
sql/sql_parse.cc:
  End statement if reading fails.
  
  Store the buffer after it has actually been updated.
sql/sql_repl.cc:
  No need to set pointer to the address of '\0'.
sql/sql_show.cc:
  Put variable under the same ifdef block.
sql/udf_example.c:
  Set null pointer flag appropriately.
storage/csv/ha_tina.cc:
  Meaningless dereferences.
storage/example/ha_example.cc:
  Return the error since it's available.
storage/myisam/mi_locking.c:
  Remove unused and dead code.

           due to GCC preprocessor change
      
The problem is that newer GCC versions treats missing headers
as fatal errors. The solution is to use a guard macro to prevent
the inclusion of system headers when checking the ABI with the
C Preprocessor.

Reference: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15638
           http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44836

Makefile.am:
  Define guard macro.
configure.in:
  Remove workaround.
include/mysql.h:
  Guard the header inclusion.
include/mysql.h.pp:
  Header is not included anymore.

           table with active trx

Essentially, the problem is that InnoDB does a implicit commit
when a cursor (table handler) is unlocked/closed, creating
a dissonance between the transaction state within the server
layer and the storage engine layer. Theoretically, a statement
transaction can encompass several table instances in a similar
manner to a multiple statement transaction, hence it does not
make sense to limit a statement transaction to the lifetime of
the table instances (cursors) used within it.

Since this particular instance of the problem is only triggerable
on 5.1 and is masked on 5.5 due 2PC being skipped (assertion is in
the prepare phase of a 2PC), the solution (which is less risky) is
to explicitly end the transaction before the cached table is unlock
on rename table.

The patch is to be null merged into trunk.

mysql-test/include/commit.inc:
  Fix counters, the binlog engine does not get involved anymore.
mysql-test/suite/innodb_plugin/r/innodb_bug54453.result:
  Add test case result for Bug#54453
mysql-test/suite/innodb_plugin/t/innodb_bug54453.test:
  Add test case for Bug#54453
sql/sql_table.cc:
  End transaction as otherwise InnoDB will end it behind our backs.