DOS ATTACKS
      
Problem:
For detailed description, see Bug#42502. This bug is a duplicate
of Bug#42502. The complete fix for Bug#42502 was not made as
proposed. Hence the bug still persists.
      
Fix:
Make the changes as proposed originally for the bugfix of 42502.
Which is to remove the allocation of the memory before we actually
check for any errors.

sql/tztime.cc:
  Remove the double allocation for tz_info

Fixing a pb2 issue.  There is some difference in the output in my local machine and pb2 machines in the explain output.  

              TO SIGNED
Problem:
When we are joining types (of fields) in case of a union, we usually
upgrade the datatypes to the largest present in the query.
In case of mediumint, it is not happening.
Analysis:
When joined with types LONG and LONGLONG, mediumint should get
upgraded to LONG and LONGLONG respectively.
W.r.t the given query, constant '1' will be created as a LONGLONG
internally and SIGNED flag is enabled. As a result, while combining
types for the field, LONGLONG along with MEDIUMINT gets converted
to LONG first. LONG with MEDIUMINT(of the third select) gets converted
to MEDIUMINT. SIGNED FLAG would be that of the first field's.
As a result, the final result would be SIGNED MEDIUMINT.
Fix:
While joining types, MEDIUMINT with LONGLONG and MEDIUMINT with LONG
is converted to LONGLONG and LONG respectively. Also, made some 
changes for FLOAT and DOUBLE.


sql/field.cc:
  Changed merge types for MEDIUMINT.

DBUG_ENTER and DBUG_LEAVE must *always* match,
otherwise all subsequent DBUG_ENTER calls will 
be poking into undefined stack frames.

Analysis:
When thread cache is enabled, it does not properly initialize
thd->start_utime when a thread is picked from the thread cache.
This breaks the quota management mechanism. 
THD::time_out_user_resource_limits() resets 
m_user_connect->conn_per_hour to 0 based on thd->start_utime

Fix:
Initialize start_utime when cached thread is reused.

Notes:
Enabled back tests which were disabled because of this issue.

This is a followup to the fix of
Bug#14628410 ASSERTION `! IS_SET()' FAILED IN DIAGNOSTICS_AREA::SET_OK_STATUS
(satya.bodapati@oracle.com-20121213132316-5joz4phltx9yhjs7)

In innobase_mysql_tmpfile(): allocate/open the file after
the return(-1); statement.

                             IN QUERY CACHE CODE

DESCRIPTION:
MySQL Server crashes sporadically when Query Caching is on and
the server has high contention among clients. 


ANALYSIS :

Scenario 1:
In Query_cache::move_by_type() when handling RESULT or its related blocks,
Write Lock is acquired on its parent Query block. However the next and prev
pointers are cached in local variables before lock acquisition. In an extremely
high contention scenario there exists a possibility that
Query_cache::append_result_data() is operating on the same query block
and as a consequence might append a new Result block to the end of Result
blocks Linked List of the Query. This would manipulate the next, prev pointers
of the Block being processed in move_by_type(), however the local pointers
still point to previous nodes there by causing Data Corruption leading to crash.

FIX :

Scenario 1:
The next, prev pointers are now accessed only after Lock acquisition in 
Query_cache::move_by_type().

SAME VERSION NUMBER 1.0.17

Now that InnoDB/InnoDB Plugin is no longer separately developed and
distributed from the MySQL server it does not need its own version number.
Thus use the MySQL version instead.

"Removing" the version altogether is not feasible because the config
variable 'innodb_version' cannot be removed in GA branches.

Reviewed by:	Marko (rb#1751)

Problem: tag's buffer overflow leads to a problem.
Fix: bound check added.


sql/item_xmlfunc.cc:
  Fix for BUG#15948580 UPDATE_XML() CRASHES THE SERVER.
  
    - XML tag/attribute level shouldn't exceed MAX_LEVEL as we use a
  static buffer to store them in the MY_XML_USER_DATA.

BUF_PAGE_GET_GEN REDUNDANT?

rb://1711
approved by: Marko Makela

When decompressing a compressed page that had already been accessed
in the buffer pool, do not attempt to merge buffered changes.

File names with colon are being disallowed because of the Alternate Data 
Stream (ADS) feature of NTFS that could be misused. ADS allows data to be 
written to alternate streams of a normal file. The data in alternate 
streams cannot be seen by normal tools on Windows (explorer, cmd.exe). As 
a result someone can use this feature to hide large amount of data in 
alternate streams and admins will have no easy way of figuring out the 
files that are using that disk space. The fix also disallows ADS in the 
scenarios where file name is passed as some dynamic variable.

An important thing about the fix is that it DOES NOT disallow ADS file 
names if they are not dynamic (i.e. if the file is created by using some 
option that needs local access to the MySQL server, for example error log
file). The reasoning is that if some MySQL option related to files 
requires access to the local machine (it is not dynamic), then user can very 
well create data in ADS by some other means. This fixes only those scenarios 
which can allow users to create data in ADS over the wire.

File names with colon are being disallowed only on Windows. UNIX 
(Linux in particular) supports NTFS, but it will not be a common 
scenario for someone to configure a NTFS file system to store MySQL 
data on Linux.

Changes in file bug11761752-master.opt are needed due to 
bug number 15937938.

The error code returned from Merge file/Temp file creation functions are
ignored.

Use the return codes of the row_merge_file_create() and innobase_mysql_tmpfile()
to return the error to caller if file creation fails.

Approved by Marko. rb#1618

              DOPROCESSREPLY()

Description: Function DoProcessReply() calls function
             decrypt_message() in a while loop without
             performing a check on available buffer
             space. This can cause buffer overflow and
             crash the server. This patch is fix provided
             by Sawtooth to resolve the issue.

ROBUST AGAINST BUGS IN CALLERS".

Both MDL subsystems and Table Definition Cache code assume 
that callers ensure that names of objects passed to them are 
not longer than NAME_LEN bytes. Unfortunately due to bugs in 
callers this assumption might be broken in some cases. As
result we get nasty bugs causing buffer overruns when we
construct MDL key or TDC key from object names.

This patch makes TDC code more robust against such bugs by 
ensuring that we always checking size of result buffer when
constructing TDC keys. This doesn't free its callers from 
ensuring that both db and table names are shorter than 
NAME_LEN bytes. But at least this steps prevents buffer 
overruns in case of bug in caller, replacing them with less 
harmful behavior.

This is 5.1-only version of patch.

This patch introduces new version of create_table_def_key()
helper function which constructs TDC key without risk of
result buffer overrun. Places in code that construct TDC keys 
were changed to use this function.

Also changed rm_temporary_table() and open_new_frm() functions
to avoid use of "unsafe" strmov() and strxmov() functions and 
use safer strnxmov() instead.

Problem:

Before the ALTER TABLE statement, the array
dict_index_t::stat_n_diff_key_vals had proper values calculated
and updated.  But after the ALTER TABLE statement, all the values
of this array is 0.  

Because of this statistics returned by innodb_rec_per_key() is
different before and after the ALTER TABLE statement. Running the
ANALYZE TABLE command populates the statistics correctly.

Solution:

After ALTER TABLE statement, set the flag dict_table_t::stat_initialized
correctly so that the table statistics will be recalculated properly when
the table is next loaded.  But note that we still don't choose the loose
index scans.  This fix only ensures that an ALTER TABLE does not change
the optimizer plan.

rb://1639 approved by Marko and Jimmy.

       
       patch to fix post push falures in pb2 

BUG#15872504 - REMOVE MYSQL-TEST/INCLUDE/GET_BINLOG_DUMP_THREAD_ID.INC
            
=== Problem ===
            
The file named "mysql-test/include/get_binlog_dump_thread_id.inc" is not 
used anywhere. In any case, this file does wrong things in the wrong way:
1) The file seems to assume there is only one dump thread, but there may 
   be many.
2) you can get this information in a much easier way using the command:
   "select thread_id from threads where processlist_command="Binlog Dump";"

=== Fix ===
          
removed file 'mysql-test/include/get_binlog_dump_thread_id.inc'

               RPL_ROW_UNTIL TIMES OUT
 
 patch to fix post push falures in pb2 

mysql-test/suite/rpl/r/rpl_row_until.result:
  changes to account for the changes made in
  corresponding test file.
mysql-test/suite/rpl/t/disabled.def:
  disabled test in macosx
mysql-test/suite/rpl/t/rpl_row_until.test:
  replaced static relayy log file by an mtr variable
  which saves the name of relay log file.

taking a change done to main 5.1 by Dmitri Lenev.

This is the original comment:

> committer: Dmitry Lenev <Dmitry.Lenev@oracle.com>
> branch nick: mysql-5.1-15954896
> timestamp: Wed 2012-12-05 19:26:56 +0400
> message:
>   Bug #15954896 "SP, MULTI-TABLE DELETE AND LONG ALIAS".

  Using too long table aliases in stored routines might
  have caused server crashes.

  Code in sp_head::merge_table_list() which is responsible
  for collecting information about tables used in stored
  routine was not aware of the fact that table alias might
  have arbitrary length. I.e. it assumed that table alias
  can't be longer than NAME_LEN bytes and allocated buffer
  for a key identifying table accordingly.

  This patch fixes the issue by ensuring that we use
  dynamically allocated buffer for table key when table
  alias is too long. By default stack based buffer is used
  in which NAME_LEN bytes are reserved for table alias.

Using too long table aliases in stored routines might
have caused server crashes.

Code in sp_head::merge_table_list() which is responsible 
for collecting information about tables used in stored
routine was not aware of the fact that table alias might
have arbitrary length. I.e. it assumed that table alias
can't be longer than NAME_LEN bytes and allocated buffer
for a key identifying table accordingly.

This patch fixes the issue by ensuring that we use
dynamically allocated buffer for table key when table
alias is too long. By default stack based buffer is used
in which NAME_LEN bytes are reserved for table alias.

      
=== Problem ===
      
The test is dependent on binlog positions and checks
to see if the command 'START SLAVE' functions correctly
with the 'UNTIL' clause added to it. The 'UNTIL' clause
is added to specify that the slave should start and run
until the SQL thread reaches a given point in the master
binary log or in the slave relay log.
      
The test uses hard coded values for MASTER_LOG_POS and
RELAY_LOG_POS, instead of extracting it using
query_get_value() function. There is a test
'rpl.rpl_row_until' which does the similar thing but uses 
query_get_value() function to set the values of
MASTER_LOG_POS/ RELAY_LOG_POS. To be precise,
rpl.rpl_row_until is a modified version of
engines/func.rpl_row_until.test.
      
The use of hard coded values may lead the slave to stop at a position
which may differ from the expected position in the binlog file,
an example being the failure of engines/funcs.rpl_row_until in 
mysql-5.1 given as: 
"query 'select * from t2' failed. Table 'test.t2' doesn't exist".
In this case, the slave actually ran a couple of extra commands
as a result of which the slave first deleted the table and then
ran a select query on table, leading to the above mentioned failure.
      
=== Fix ===
    
1) Fixed the code for failure seen in rpl.rpl_row_until.
   This test was also failing although the symptoms of
   failure were different.
2) Copied the contents from rpl.rpl_row_until into
   into engines/funcs.rpl.rpl_row_until.
3) Updated engines/funcs.rpl_row_until.result accordingly.

mysql-test/suite/engines/funcs/r/rpl_row_until.result:
  modified to accomodate the changes in corresponding
  test file.
mysql-test/suite/engines/funcs/t/disabled.def:
  removed from the list of disabled tests.
mysql-test/suite/engines/funcs/t/rpl_row_until.test:
  fixed rpl.rpl_row_until and copied its content to
  engines/funcs.rpl_row_until. The reason being both
  are same tests but rpl.rpl_row_until is an
  updated version.
mysql-test/suite/rpl/t/disabled.def:
  removed from the list of disabled tests.
sql/sql_repl.cc:
  Added a check to catch an improper combination
  of arguements passed to 'START SLAVE UNTIL'. Earlier,
  START SLAVE UNTIL MASTER_LOG_FILE='master-bin.000001',
  MASTER_LOG_POS=561, RELAY_LOG_POS=12;
  passed. It is now detected and an error is reported.

FORMAT_DESCRIPTION_LOG_EVENT::CALC_SERVER_VERSION_SPLIT

Problem: When reading a Format_description_log_event, it supposes MySQL
version is always valid and DBUG_ASSERTION is used check the version number.
However, user may give a wrong binlog offset, even give a faked binary event
which includes an invalid MySQL version. This will cause server crash.

Fix: The assertions are removed and an error will be reported if MySQL
version in Format_description_log_event is invalid.

                           IN DEACTIVATE_DDL_LOG_ENTRY

Update of comments according to reviewers request.

revid that is being reverted: marko.makela@oracle.com-20121128070024-hb56t41limja8edz

=== Problem ===

The test is dependent on binlog positions and checks
to see if the command 'START SLAVE' functions correctly
with the 'UNTIL' clause added to it. The 'UNTIL' clause
is added to specify that the slave should start and run
until the SQL thread reaches a given point in the master
binary log or in the slave relay log.

The test uses hard coded values for MASTER_LOG_POS and
RELAY_LOG_POS, instead of extracting it using
query_get_value() function. There is a test
'rpl.rpl_row_until' which does the similar thing but uses 
query_get_value() function to set the values of
MASTER_LOG_POS/ RELAY_LOG_POS. To be precise,
rpl.rpl_row_until is a modified version of
engines/func.rpl_row_until.test.

The use of hard coded values may lead the slave to stop at a position
which may differ from the expected position in the binlog file,
an example being the failure of engines/funcs.rpl_row_until in 
mysql-5.1 given as: 
"query 'select * from t2' failed. Table 'test.t2' doesn't exist".
In this case, the slave actually ran a couple of extra commands
as a result of which the slave first deleted the table and then
ran a select query on table, leading to the above mentioned failure.

=== Fix ===

1) Fixed the code for failure seen in rpl.rpl_row_until.
   This test was also failing although the symptoms of
   failure were different.
2) Copied the contents from rpl.rpl_row_until into
   into engines/funcs.rpl.rpl_row_until.
3) Updated engines/funcs.rpl_row_until.result accordingly.

mysql-test/suite/engines/funcs/r/rpl_row_until.result:
  modified to accomodate the changes in corresponding
  test file.
mysql-test/suite/engines/funcs/t/disabled.def:
  removed from the list of disabled tests.
mysql-test/suite/engines/funcs/t/rpl_row_until.test:
  fixed rpl.rpl_row_until and copied its content to
  engines/funcs.rpl_row_until. The reason being both
  are same tests but rpl.rpl_row_until is an
  updated version.
mysql-test/suite/rpl/t/disabled.def:
  removed from the list of disabled tests.
sql/sql_repl.cc:
  Added a check to catch an improper combination
  of arguements passed to 'START SLAVE UNTIL'. Earlier,
  START SLAVE UNTIL MASTER_LOG_FILE='master-bin.000001',
  MASTER_LOG_POS=561, RELAY_LOG_POS=12;
  passed. It is now detected and an error is reported.

Description: A very large database name causes buffer
             overflow in functions acl_get() and
             check_grant_db() in sql_acl.cc. It happens
             due to an unguarded string copy operation.
             This puts required sanity checks before
             copying db string to destination buffer.

The converted implicit lock should wait for the prior conflicting lock if found.

rb://1437 approved by Marko

BUF_PAGE_GET_GEN REDUNDANT?

buf_page_get_gen(): When decompressing a compressed page that had
already been accessed in the buffer pool, do not attempt to merge
buffered changes.

rb:1602 approved by Inaam Rana

 trx_undo_prev_version_build() should confirm existence of inherited (not-own) external pages.

Bug #14676084 : ROW_UNDO_MOD_UPD_DEL_SEC() DOESN'T NEED UNDO_ROW AND UNDO_EXT INITIALIZED
 mtr script could hit the assertion error !bpage->file_page_was_freed using this path.
 So, also fixed

rb://1337 approved by Marko Makela.

Description: Updated yassl to version 2.2.2

rb://1546
approved by: Sunny Bains and Marko Makela

Our dealing of buf_page_t::access_time flag is inaccurate.
* If LRU eviction has not started we don't set the access_time
* If LRU eviction is started we set it only if the block is not
'too old'.
* Not a correctness issue but we hold buf_pool::mutex when
setting the flag

This patch fixes this by:
* Setting flag unconditionally whenever the first page access happens
* Use buf_page_t mutex to protect write to the flag

The problem is related to the changes made in bug#13025132.
get_partition_set can do dynamic pruning which limits the partitions
to scan even further. This is not accounted for when setting
the correct start of the preallocated record buffer used in
the priority queue, thus leading to wrong buffer is used
(including wrong preset partitioning id, connected to that buffer).

Solution is to fast forward the buffer pointer to point to the correct
partition record buffer.

No commit message

Remove a bogus debug assertion.

CHAR(n) in ROW_FORMAT=REDUNDANT tables is always fixed-length
(n*mbmaxlen bytes), but in the temporary file it is variable-length
(n*mbminlen to n*mbmaxlen bytes) for variable-length character sets,
such as UTF-8.

The temporary file format used during index creation and online ALTER
TABLE is based on ROW_FORMAT=COMPACT. Thus, it should use the
variable-length encoding even if the base table is in
ROW_FORMAT=REDUNDNAT.

dtype_get_fixed_size_low(): Replace an assertion-like check with a
debug assertion.

rec_init_offsets_comp_ordinary(), rec_convert_dtuple_to_rec_comp():
Make this an inline function.  Replace 'ulint extra' with 'bool temp'.

rec_get_converted_size_comp_prefix_low(): Renamed from
rec_get_converted_size_comp_prefix(), and made inline. Add the
parameter 'bool temp'. If temp=true, do not add REC_N_NEW_EXTRA_BYTES.

rec_get_converted_size_comp_prefix(): Remove the comment about
dict_table_is_comp(). This function is only to be called for other
than ROW_FORMAT=REDUNDANT records.

rec_get_converted_size_temp(): New function for computing temporary
file record size. Omit REC_N_NEW_EXTRA_BYTES from the sizes.

rec_init_offsets_temp(), rec_convert_dtuple_to_temp(): New functions,
for operating on temporary file records.

rb:1559 approved by Jimmy Yang