1. 11 Oct, 2006 1 commit
  2. 09 Oct, 2006 2 commits
    • unknown's avatar
      Merge bk-internal.mysql.com:/home/bk/mysql-4.1-maint · 41237151
      unknown authored
      into  zippy.cornsilk.net:/home/cmiller/work/mysql/bug17583/my41-bug17583
      
      
      client/mysql.cc:
        Auto merged
      41237151
    • unknown's avatar
      Bug#17583: mysql drops connection when stdout is not writable · 8af12677
      unknown authored
      When the client program had its stdout file descriptor closed by the calling
      shell, after some amount of work (enough to fill a socket buffer) the server 
      would complain about a packet error and then disconnect the client.
      
      This is a serious security problem.  If stdout is closed before the mysql is
      exec()d, then the first socket() call allocates file number 1 to communicate
      with the server.  Subsequent write()s to that file number (as when printing
      results that come back from the database) go back to the server instead in 
      the command channel.  So, one should be able to craft data which, upon being
      selected back from the server to the client, and injected into the command
      stream become valid MySQL protocol to do something nasty when sent /back/ to 
      the server.
      
      The solution is to close explicitly the file descriptor that we *printf() to, 
      so that the libc layer and the OS layer both agree that the file is closed.
      
      
      BitKeeper/etc/collapsed:
        BitKeeper file /home/cmiller/work/mysql/bug17583/my41-bug17583/BitKeeper/etc/collapsed
      client/mysql.cc:
        If standard output is not open (specifically, if dup() of its file number 
        fails) then we explicitly close it so that future uses of the file descriptor
        behave correctly for a closed file.
      mysql-test/r/mysql_client.result:
        Prove that the problem of writing SQL output to the command socket no longer
        exists.
      mysql-test/t/mysql_client.test:
        Prove that the problem of writing SQL output to the command socket no longer
        exists.
      8af12677
  3. 04 Oct, 2006 1 commit
  4. 03 Oct, 2006 8 commits
  5. 02 Oct, 2006 13 commits
  6. 30 Sep, 2006 3 commits
  7. 29 Sep, 2006 5 commits
  8. 28 Sep, 2006 7 commits
    • unknown's avatar
      Merge rolltop.ignatz42.dyndns.org:/mnt/storeage/bug20305/my41-bug20305 · 6c8588a3
      unknown authored
      into  rolltop.ignatz42.dyndns.org:/mnt/storeage/mysql-4.1-maint
      
      6c8588a3
    • unknown's avatar
      Fix for bug#22338 "Valgrind warning: uninitialized variable in · 3385bda9
      unknown authored
      create_tmp_table()".
      
      The fix for bug 21787 "COUNT(*) + ORDER BY + LIMIT returns wrong
      result" introduced valgrind warnings which occured during execution
      of information_schema.test and sp-prelocking.test in version 5.0.
      There were no user visible effects.
      
      The latter fix made create_tmp_table() dependant on
      THD::lex::current_select value. Valgrind warnings occured when this
      function was executed and THD::lex::current_select member pointed
      to uninitialized SELECT_LEX instance.
      
      This fix tries to remove this dependancy by moving some logic
      outside of create_tmp_table() function.
      
      
      sql/sql_select.cc:
        create_tmp_table():
          Moved code which is responsible for determining if optimization
          which pushes down LIMIT clause to temporary table creation is
          applicable out of this function.
          Such move made this function independant of THD::lex::current_select
          value and removed valgrind warnings which occured in cases when this
          member pointed to uninitialized SELECT_LEX object (particularly these
          warnings occured in sp-prelocking.test and information_schema.test
          in 5.0). This seems like a better solution than trying to force this
          pointer always to point to relevant select because:
          - In some cases when we use create_tmp_table() there are no relevant
            SELECT_LEX object (we use it just to create temporary table/object).
          - There is only one place in code where we call this funciton and
            where this optimization can be enabled. And in this place we
            already have some logic which tries to determine if it is applicable.
      3385bda9
    • unknown's avatar
      Merge chilla.local:/home/mydev/mysql-4.0-bug22384 · d198c072
      unknown authored
      into  chilla.local:/home/mydev/mysql-4.1-bug22384
      
      
      myisam/mi_delete.c:
        Auto merged
      d198c072
    • unknown's avatar
      Bug#20305: PROCEDURE ANALYSE() returns wrong M for FLOAT(M, D) and DOUBLE(M, D) · 155b417c
      unknown authored
      
      mysql-test/r/analyse.result:
        Added Results
      mysql-test/t/analyse.test:
        Added test cases to make sure field_str and field_real return correctly.
      sql/sql_analyse.cc:
        According the manaul, when declaring a FLOAT(M, N), N equals the number of decimal places and M equals the total number of
        digits in the number.
      155b417c
    • unknown's avatar
      Merge mysql.com:/home/svoj/devel/bk/mysql-4.1-engines · a93e2871
      unknown authored
      into  mysql.com:/home/svoj/devel/mysql/BUG21617/mysql-4.1-engines
      
      
      myisammrg/myrg_open.c:
        Auto merged
      mysql-test/r/merge.result:
        Manual merge.
      mysql-test/t/merge.test:
        Manual merge.
      a93e2871
    • unknown's avatar
      BUG#21617 - crash when selecting from merge table with inconsistent indexes · 1c6bca02
      unknown authored
      Crash may happen when selecting from a merge table that has underlying
      tables with less indexes than in a merge table itself.
      
      If number of keys in merge table is not bigger than requested key number,
      return error.
      
      
      myisammrg/myrg_open.c:
        Store min(number of keys) in m_info instead of number of keys in last
        underlying table.
      myisammrg/myrg_queue.c:
        Return error if inx passed to _myrg_init_queue function is not less
        than number of keys.
      mysql-test/r/merge.result:
        A test case for bug#21617.
      mysql-test/t/merge.test:
        A test case for bug#21617.
      mysys/queues.c:
        Replaced annoying ifndef DBUG_OFF with DBUG_ASSERT, fixed coding style.
        The problem was that having queue overrun in debug build was hidden
        with this ifdef.
      1c6bca02
    • unknown's avatar
      Merge bk-internal.mysql.com:/home/bk/mysql-4.1 · 14f24a8f
      unknown authored
      into  zippy.cornsilk.net:/home/cmiller/work/mysql/mysql-4.1-maint
      
      
      mysql-test/r/ctype_utf8.result:
        Manual merge.
      mysql-test/t/ctype_utf8.test:
        Manual merge.
      14f24a8f