1. 17 Dec, 2007 1 commit
  2. 06 Dec, 2007 1 commit
    • unknown's avatar
      Bug#31752: check strmake() bounds · 14e9797e
      unknown authored
      post-fixes: prevent semi-related overflow, additional comments
      
      
      mysys/mf_pack.c:
        extra comments
      sql/log.cc:
        prevent overflow (length parameter of strmake() should
        never become < 0)
      sql/sql_show.cc:
        additional comments
      sql/unireg.cc:
        additional comments
      14e9797e
  3. 26 Nov, 2007 3 commits
    • unknown's avatar
      Bug#31752: check strmake() bounds · 5e6d906e
      unknown authored
      strmake() called with wrong parameters:
      5.0-specific fixes.
      
      
      client/mysql.cc:
        In debug-mode, strmake() fills unused part of buffer with
        a test-pattern. This overwrites our previous extra '\0'
        (from previous bzero()).
      sql/sp.cc:
        off-by-one buffer-size.
      5e6d906e
    • unknown's avatar
      Merge mysql.com:/misc/mysql/31752_/41-31752_ · 8c784b8c
      unknown authored
      into  mysql.com:/misc/mysql/31752_/50-31752_
      
      
      sql/log.cc:
        Auto merged
      sql/repl_failsafe.cc:
        Auto merged
      sql/set_var.cc:
        Auto merged
      strings/strmake.c:
        Auto merged
      sql/sql_show.cc:
        manually merged
      sql/unireg.cc:
        manual merge
      8c784b8c
    • unknown's avatar
      Bug#31752: check strmake() bounds · f61a4c8c
      unknown authored
      strmake() calls are easy to get wrong. Add checks in extra
      debug mode to identify possible exploits.
      
      Remove some dead code.
      
      Remove some off-by-one errors identified with new checks.
      
      
      sql/log.cc:
        fix off-by-one buffer-length argument to prevent stack smashing
      sql/repl_failsafe.cc:
        fix off-by-one buffer-length argument to prevent stack smashing
      sql/set_var.cc:
        fix off-by-one buffer-length argument to prevent stack smashing
        (already approved, backports #31588)
      sql/sql_show.cc:
        misdimensioned buffers: functions further down the callstack
        expect bufsize of FN_REFLEN
      sql/unireg.cc:
        When EXTRA_DEBUG is enabled, strmake() will write funny patterns to
        buffers it operates on to identify possibly overflows. This leads to
        badness in mysql_create_frm(), so we explicitly put any unused bytes
        (back) into a defined state. Not a bug-fix, but part of the strmake()
        bug detector.
      strings/strmake.c:
        strmake() takes maximum string length rather than buffer-length
        (string length + 1 to accomodate \0 terminator) as argument.
        Since this is easy to get wrong, add extra debug code to identify
        off-by-ones so we can prevent stack smashing.
        
        Alternative "BAD_STRING_COMPILER" removed after checking
        with Monty.
      f61a4c8c
  4. 22 Nov, 2007 1 commit
  5. 19 Nov, 2007 1 commit
    • unknown's avatar
      Fix for bug #32221: bug25714, mytest, mysql_client_test complaints and · 53dfb5a9
      unknown authored
      crashes.
      
      MySQL distributions contain a number of programs that are used only by
      the MySQL test suite internally, i.e. they are not indended to be
      invoked directly by a user. As a result, such programs are not
      documented, do not have any built-in help or proper error reporting,
      which may confuse users.
      
      This patch fixes the problem with the following changes:
      - mytest, libmysqltest and all references to them were removed from the
      distribution since they are not used anymore
      - bug25714 now displays an error message when run with incorrect
      arguments or with the --help option
      - mysql_client_test now does not call abort() in case of errors,
      instead it does a clean exit() with a proper error status.
      
      
      BitKeeper/deleted/.del-mytest.c:
        Delete: libmysql/mytest.c
      BitKeeper/deleted/.del-myTest-package.dsp:
        Delete: VC++Files/libmysqltest/myTest-package.dsp
      BitKeeper/deleted/.del-myTest-package_ia64.dsp:
        Delete: VC++Files/libmysqltest/myTest-package_ia64.dsp
      BitKeeper/deleted/.del-myTest.dsp~4a8c480769193952:
        Delete: VC++Files/libmysqltest/myTest.dsp
      BitKeeper/deleted/.del-myTest.vcproj:
        Delete: VC++Files/libmysqltest/myTest.vcproj
      BitKeeper/deleted/.del-myTest_ia64.dsp:
        Delete: VC++Files/libmysqltest/myTest_ia64.dsp
      BitKeeper/deleted/.del-mytest.c~9a99338689e5de8:
        Delete: VC++Files/libmysqltest/mytest.c
      BitKeeper/deleted/.del-mytest.dsw~2324698861155335:
        Delete: VC++Files/libmysqltest/mytest.dsw
      VC++Files/copy_mysql_files.bat:
        Removed references to libmysqltest.
      libmysql/CMakeLists.txt:
        Removed rules for myTest.
      libmysql/Makefile.am:
        Removed mytest.c from EXTRA_DIST.
      tests/bug25714.c:
        Display a meaningful error message when run incorrectly or with the --help option.
      tests/mysql_client_test.c:
        In case of error, don't cause abnormal program termination, do a clean exit() with an error status.
      53dfb5a9
  6. 09 Nov, 2007 1 commit
    • unknown's avatar
      Fix for bug #32020: loading udfs while --skip-grant-tables is enabled · bae65dd2
      unknown authored
      causes out of memory errors
      
      The code in mysql_create_function() and mysql_drop_function() assumed
      that the only reason for UDFs being uninitialized at that point is an
      out-of-memory error during initialization. However, another possible 
      reason for that is the --skip-grant-tables option in which case UDF 
      initialization is skipped and UDFs are unavailable.
      
      The solution is to check whether mysqld is running with
      --skip-grant-tables and issue a proper error in such a case.
      
      
      mysql-test/r/skip_grants.result:
        Added a test case for bug #32020.
      mysql-test/t/skip_grants.test:
        Added a test case for bug #32020.
      sql/sql_udf.cc:
        Issue a proper error when a user tries to CREATE/DROP a UDF 
        on a server running with the --skip-grant-tables option.
      bae65dd2
  7. 21 Oct, 2007 1 commit
    • unknown's avatar
      Bug #28550 "Potential bugs related to the return type of the CHAR function". · 0ca57427
      unknown authored
        
      Since, as of MySQL 5.0.15, CHAR() arguments larger than 255 are converted into multiple result bytes, a single CHAR() argument can now take up to 4 bytes. This patch fixes Item_func_char::fix_length_and_dec() to take this into account.
        
      This patch also fixes a regression introduced by the patch for bug21513. As now we do not always have the 'name' member of Item set for Item_hex_string and Item_bin_string, an own print() method has been added to Item_hex_string so that it could correctly be printed by Item_func::print_args().
      
      
      mysql-test/r/func_str.result:
        Import patch bug288550.patch
      mysql-test/t/func_str.test:
        Import patch bug288550.patch
      sql/item.cc:
        Import patch bug288550.patch
      sql/item.h:
        Import patch bug288550.patch
      sql/item_strfunc.h:
        Import patch bug288550.patch
      0ca57427
  8. 17 Oct, 2007 1 commit
  9. 16 Oct, 2007 1 commit
  10. 15 Oct, 2007 2 commits
  11. 14 Oct, 2007 1 commit
    • unknown's avatar
      item_sum.cc: · e2fa4b6e
      unknown authored
        Fixed dbug macros usage errors
      
      
      sql/item_sum.cc:
        Fixed dbug macros usage errors
      e2fa4b6e
  12. 13 Oct, 2007 2 commits
  13. 12 Oct, 2007 3 commits
  14. 11 Oct, 2007 3 commits
    • unknown's avatar
      Merge gleb.loc:/home/uchum/work/bk/PA/5.0-opt-31471 · 5bf0a2ec
      unknown authored
      into  gleb.loc:/home/uchum/work/bk/5.0-opt
      
      5bf0a2ec
    • unknown's avatar
      Bug#30981 CHAR(0x41 USING ucs2) doesn't add leading zero · 835746d0
      unknown authored
      Bug#30982 CHAR(..USING..) can return a not-well-formed string
      Bug#30986 Character set introducer followed by a HEX string can return bad result
      check_well_formed_result moved to Item from Item_str_func
      fixed Item_func_char::val_str for proper ucs symbols converting
      added check for well formed strings for correct conversion of constants with underscore
      charset
      
      
      mysql-test/r/ctype_ucs.result:
        test result
      mysql-test/r/ctype_utf8.result:
        test result
      mysql-test/t/ctype_ucs.test:
        test case
      mysql-test/t/ctype_utf8.test:
        test case
      sql/item.cc:
        check_well_formed_result() moved from Item_str_func
      sql/item.h:
        check_well_formed_result() moved from Item_str_func
      sql/item_strfunc.cc:
        check_well_formed_result moved to Item
        fixed Item_func_char::val_str for proper ucs symbols converting
      sql/item_strfunc.h:
        check_well_formed_result moved to Item
      sql/sql_yacc.yy:
        added check for well formed string
      835746d0
    • unknown's avatar
      Bug #31440: 'select 1 regex null' asserts debug server · 6bae70ba
      unknown authored
      The special case with NULL as a regular expression
      was handled at prepare time. But in this special case
      the item was not marked as fixed. This caused an assertion
      at execution time.
      Fixed my marking the item as fixed even when known to 
      return NULL at prepare time.
      
      
      mysql-test/r/func_regexp.result:
        Bug #31440: test case
      mysql-test/t/func_regexp.test:
        Bug #31440: test case
      sql/item_cmpfunc.cc:
        Bug #31440: mark the item as fixed even when 
        known to return NULL.
      6bae70ba
  15. 10 Oct, 2007 4 commits
    • unknown's avatar
      Fixed bug #31471: decimal_bin_size: Assertion `scale >= 0 && · f23d0bc7
      unknown authored
                        precision > 0 && scale <= precision'.
      
      A sign of a resulting item of the IFNULL function was not
      updated and the maximal length of this result was calculated
      improperly. Correct algorithm was copy&pasted from the IF
      function implementation.
      
      
      sql/item_cmpfunc.cc:
        Fixed bug #31471.
        The Item_func_ifnull::fix_length_and_dec method has been
        modified to update the Item_func_ifnull::unsigned_flag field
        and to take this field into account when calculating the
        Item_func_ifnull::max_length value.
        (See Item_func_if::fix_length_and_dec for reference).
      mysql-test/t/null.test:
        Added test case for bug #31471.
      mysql-test/r/null.result:
        Added test case for bug #31471.
      mysql-test/r/create.result:
        Update test case after the bugfix of bug #31471.
      f23d0bc7
    • unknown's avatar
      Merge mysql.com:/home/gluh/MySQL/Merge/5.0 · d20c3355
      unknown authored
      into  mysql.com:/home/gluh/MySQL/Merge/5.0-opt
      
      
      libmysql/libmysql.c:
        Auto merged
      d20c3355
    • unknown's avatar
      Bug#28893 --relay-log variable is not exposed with SHOW VARIABLES · 8c53b726
      unknown authored
      added variables relay_log, relay_log_index, relay_log_info_file to init_vars[]
      to make them visible within SHOW VARIABLES
      
      
      mysql-test/r/rpl_flush_log_loop.result:
        test result
      mysql-test/t/rpl_flush_log_loop.test:
        test case
      sql/set_var.cc:
        added variables relay_log, relay_log_index, relay_log_info_file to init_vars[]
        to make them visible within SHOW VARIABLES
      8c53b726
    • unknown's avatar
      Bug#25359 Test 'view' is dependent on current year to be 2006 · e2ef1cfd
      unknown authored
      removed now() call to make the test to be year independent
      
      
      mysql-test/r/view.result:
        result fix
      mysql-test/t/view.test:
        removed now() call to make the test to be year independent
      e2ef1cfd
  16. 09 Oct, 2007 5 commits
  17. 08 Oct, 2007 1 commit
    • unknown's avatar
      Bug #31156: mysqld: item_sum.cc:918: virtual bool · 7b85689a
      unknown authored
        Item_sum_distinct::setup(THD*): Assertion
      
      There was an assertion to detect a bug in ROLLUP
      implementation. However the assertion is not true
      when used in a subquery context with non-cacheable
      statements.
      Fixed by turning the assertion to accepted case
      (just like it's done for the other aggregate functions). 
      
      
      mysql-test/r/func_group.result:
        Bug #31156: test case
      mysql-test/t/func_group.test:
        Bug #31156: test case
      sql/item_sum.cc:
        Bug #31156: make it OK to call setup() several times:
         done for (e.g.) scalar subquery
      7b85689a
  18. 07 Oct, 2007 1 commit
    • unknown's avatar
      Fixed bug #31019: the MOD() function and the % operator crash the server · 91dc1bb9
      unknown authored
      when a divisor is less than 1 and its fractional part is very long.
      For example:
      1 % .123456789123456789123456789123456789123456789123456789123456789123456789123456789;
      
      Stack buffer overflow has been fixed in the do_div_mod function.
      
      
      strings/decimal.c:
        Fixed bug #31019.
        Stack buffer overflow has been fixed in the do_div_mod function:
        a value of the upper bound of the buffer was increased where
        a decrement is required.
      mysql-test/t/type_decimal.test:
        Added test case for bug #31019.
      mysql-test/r/type_decimal.result:
        Added test case for bug #31019.
      91dc1bb9
  19. 05 Oct, 2007 7 commits