merge from 5.1 main

CMakeLists.txt

@@ -59,6 +59,7 @@ ADD_DEFINITIONS(-D__NT__)
 
 IF(CYBOZU)
   ADD_DEFINITIONS(-DCYBOZU)
+  ADD_DEFINITIONS(-DHAVE_UTF8_GENERAL_CS)
 ENDIF(CYBOZU)
 
 IF(EXTRA_DEBUG)

extra/yassl/src/yassl_int.cpp

@@ -308,7 +308,7 @@ SSL::SSL(SSL_CTX* ctx)
             SetError(YasslError(err));
             return;
         }
-        else if (serverSide) {
+        else if (serverSide && !(ctx->GetCiphers().setSuites_)) {
             // remove RSA or DSA suites depending on cert key type
             ProtocolVersion pv = secure_.get_connection().version_;
             

mysql-test/r/analyse.result

@@ -123,3 +123,16 @@ CREATE TABLE t2 SELECT 1 FROM t1, t1 t3 GROUP BY t3.a PROCEDURE ANALYSE();
 ERROR HY000: Incorrect usage of PROCEDURE and non-SELECT
 DROP TABLE t1;
 End of 5.0 tests
+#
+# Bug#11765202: Dbug_violation_helper::~Dbug_violation_helper(): Assertion `!_entered' failed.
+#
+DROP TABLE IF EXISTS t1;
+Warnings:
+Note	1051	Unknown table 't1'
+CREATE TABLE t1 (a VARCHAR(2) CHARSET UTF8 NOT NULL);
+INSERT INTO t1 VALUES ('e'),('e'),('e-');
+SELECT * FROM t1 PROCEDURE ANALYSE();
+Field_name	Min_value	Max_value	Min_length	Max_length	Empties_or_zeros	Nulls	Avg_value_or_avg_length	Std	Optimal_fieldtype
+test.t1.a	e	e-	1	2	0	0	1.3333	NULL	ENUM('e','e-') NOT NULL
+DROP TABLE t1;
+End of 5.1 tests

mysql-test/r/events_bugs.result

@@ -747,6 +747,15 @@ event_name	originator
 ev1	4294967295
 DROP EVENT ev1;
 SET GLOBAL server_id = @old_server_id;
+CREATE DATABASE event_test1;
+USE event_test1;
+CREATE EVENT ev1 ON SCHEDULE EVERY 1 DAY DO SELECT 1;
+CREATE DATABASE event_test2;
+USE event_test2;
+SHOW EVENTS;
+Db	Name	Definer	Time zone	Type	Execute at	Interval value	Interval field	Starts	Ends	Status	Originator	character_set_client	collation_connection	Database Collation
+DROP DATABASE event_test1;
+DROP DATABASE event_test2;
 DROP DATABASE events_test;
 SET GLOBAL event_scheduler= 'ON';
 SET @@global.concurrent_insert= @concurrent_insert;

mysql-test/r/mysqldump.result

@@ -4626,6 +4626,7 @@ DELIMITER ;
 /*!50003 SET collation_connection  = @saved_col_connection */ ;
 ALTER DATABASE `test-database` CHARACTER SET utf8 COLLATE utf8_unicode_ci ;
 DROP DATABASE `test-database`;
+USE `test`;
 #
 # End of 5.1 tests
 #

mysql-test/r/ssl_cipher.result

+#
+# BUG#11760210 - SSL_CIPHER_LIST NOT SET OR RETURNED FOR "SHOW STATUS LIKE 'SSL_CIPHER_LIST'"
+#
+SHOW STATUS LIKE 'Ssl_cipher';
+Variable_name	Value
+Ssl_cipher	AES128-SHA
+SHOW STATUS LIKE 'Ssl_cipher_list';
+Variable_name	Value
+Ssl_cipher_list	AES128-SHA

mysql-test/r/variables.result

@@ -1540,6 +1540,9 @@ ERROR HY000: Cannot drop default keycache
 SET @@global.key_cache_block_size=0;
 Warnings:
 Warning	1292	Truncated incorrect key_cache_block_size value: '0'
+select @@max_long_data_size;
+@@max_long_data_size
+1048576
 SET @@global.max_binlog_cache_size=DEFAULT;
 SET @@global.max_join_size=DEFAULT;
 SET @@global.key_buffer_size=@kbs;

mysql-test/suite/funcs_1/r/is_columns_myisam_embedded.result

@@ -479,9 +479,9 @@ NULL	test	tb1	f27	27	NULL	YES	int	NULL	NULL	10	0	NULL	NULL	int(10) unsigned zero
 NULL	test	tb1	f28	28	NULL	YES	int	NULL	NULL	10	0	NULL	NULL	int(10) unsigned zerofill				
 NULL	test	tb1	f29	29	NULL	YES	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20)				
 NULL	test	tb1	f3	3	NULL	YES	char	1	1	NULL	NULL	latin1	latin1_swedish_ci	char(1)				
-NULL	test	tb1	f30	30	NULL	YES	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned				
-NULL	test	tb1	f31	31	NULL	YES	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned zerofill				
-NULL	test	tb1	f32	32	NULL	YES	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned zerofill				
+NULL	test	tb1	f30	30	NULL	YES	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned				
+NULL	test	tb1	f31	31	NULL	YES	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned zerofill				
+NULL	test	tb1	f32	32	NULL	YES	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned zerofill				
 NULL	test	tb1	f33	33	10	NO	decimal	NULL	NULL	10	0	NULL	NULL	decimal(10,0)				
 NULL	test	tb1	f34	34	10	NO	decimal	NULL	NULL	10	0	NULL	NULL	decimal(10,0) unsigned				
 NULL	test	tb1	f35	35	0000000010	NO	decimal	NULL	NULL	10	0	NULL	NULL	decimal(10,0) unsigned zerofill				
@@ -602,9 +602,9 @@ NULL	test	tb3	f143	26	99999	NO	int	NULL	NULL	10	0	NULL	NULL	int(10) unsigned
 NULL	test	tb3	f144	27	0000099999	NO	int	NULL	NULL	10	0	NULL	NULL	int(10) unsigned zerofill				
 NULL	test	tb3	f145	28	0000099999	NO	int	NULL	NULL	10	0	NULL	NULL	int(10) unsigned zerofill				
 NULL	test	tb3	f146	29	999999	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20)				
-NULL	test	tb3	f147	30	999999	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned				
-NULL	test	tb3	f148	31	00000000000000999999	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned zerofill				
-NULL	test	tb3	f149	32	00000000000000999999	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned zerofill				
+NULL	test	tb3	f147	30	999999	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned				
+NULL	test	tb3	f148	31	00000000000000999999	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned zerofill				
+NULL	test	tb3	f149	32	00000000000000999999	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned zerofill				
 NULL	test	tb3	f150	33	1000	NO	decimal	NULL	NULL	10	0	NULL	NULL	decimal(10,0)				
 NULL	test	tb3	f151	34	999	NO	decimal	NULL	NULL	10	0	NULL	NULL	decimal(10,0) unsigned				
 NULL	test	tb3	f152	35	0000001000	NO	decimal	NULL	NULL	10	0	NULL	NULL	decimal(10,0) unsigned zerofill				

mysql-test/suite/funcs_1/r/is_columns_mysql_embedded.result

@@ -97,13 +97,13 @@ NULL	mysql	host	Select_priv	3	N	NO	enum	1	3	NULL	NULL	utf8	utf8_general_ci	enum(
 NULL	mysql	host	Show_view_priv	16	N	NO	enum	1	3	NULL	NULL	utf8	utf8_general_ci	enum('N','Y')				
 NULL	mysql	host	Trigger_priv	20	N	NO	enum	1	3	NULL	NULL	utf8	utf8_general_ci	enum('N','Y')				
 NULL	mysql	host	Update_priv	5	N	NO	enum	1	3	NULL	NULL	utf8	utf8_general_ci	enum('N','Y')				
-NULL	mysql	ndb_binlog_index	deletes	6	NULL	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned				
-NULL	mysql	ndb_binlog_index	epoch	3	NULL	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned	PRI			
+NULL	mysql	ndb_binlog_index	deletes	6	NULL	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned				
+NULL	mysql	ndb_binlog_index	epoch	3	NULL	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned	PRI			
 NULL	mysql	ndb_binlog_index	File	2	NULL	NO	varchar	255	255	NULL	NULL	latin1	latin1_swedish_ci	varchar(255)				
-NULL	mysql	ndb_binlog_index	inserts	4	NULL	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned				
-NULL	mysql	ndb_binlog_index	Position	1	NULL	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned				
-NULL	mysql	ndb_binlog_index	schemaops	7	NULL	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned				
-NULL	mysql	ndb_binlog_index	updates	5	NULL	NO	bigint	NULL	NULL	19	0	NULL	NULL	bigint(20) unsigned				
+NULL	mysql	ndb_binlog_index	inserts	4	NULL	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned				
+NULL	mysql	ndb_binlog_index	Position	1	NULL	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned				
+NULL	mysql	ndb_binlog_index	schemaops	7	NULL	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned				
+NULL	mysql	ndb_binlog_index	updates	5	NULL	NO	bigint	NULL	NULL	20	0	NULL	NULL	bigint(20) unsigned				
 NULL	mysql	plugin	dl	2		NO	char	128	384	NULL	NULL	utf8	utf8_bin	char(128)				
 NULL	mysql	plugin	name	1		NO	char	64	192	NULL	NULL	utf8	utf8_bin	char(64)	PRI			
 NULL	mysql	proc	body	11	NULL	NO	longblob	4294967295	4294967295	NULL	NULL	NULL	NULL	longblob				
@@ -130,7 +130,7 @@ NULL	mysql	procs_priv	Db	2		NO	char	64	192	NULL	NULL	utf8	utf8_bin	char(64)	PRI
 NULL	mysql	procs_priv	Grantor	6		NO	char	77	231	NULL	NULL	utf8	utf8_bin	char(77)	MUL			
 NULL	mysql	procs_priv	Host	1		NO	char	60	180	NULL	NULL	utf8	utf8_bin	char(60)	PRI			
 NULL	mysql	procs_priv	Proc_priv	7		NO	set	27	81	NULL	NULL	utf8	utf8_general_ci	set('Execute','Alter Routine','Grant')				
-NULL	mysql	procs_priv	Routine_name	4		NO	char	64	192	NULL	NULL	utf8	utf8_bin	char(64)	PRI			
+NULL	mysql	procs_priv	Routine_name	4		NO	char	64	192	NULL	NULL	utf8	utf8_general_ci	char(64)	PRI			
 NULL	mysql	procs_priv	Routine_type	5	NULL	NO	enum	9	27	NULL	NULL	utf8	utf8_bin	enum('FUNCTION','PROCEDURE')	PRI			
 NULL	mysql	procs_priv	Timestamp	8	CURRENT_TIMESTAMP	NO	timestamp	NULL	NULL	NULL	NULL	NULL	NULL	timestamp		on update CURRENT_TIMESTAMP		
 NULL	mysql	procs_priv	User	3		NO	char	16	48	NULL	NULL	utf8	utf8_bin	char(16)	PRI			
@@ -411,7 +411,7 @@ NULL	mysql	proc	modified	timestamp	NULL	NULL	NULL	NULL	timestamp
 3.0000	mysql	procs_priv	Host	char	60	180	utf8	utf8_bin	char(60)
 3.0000	mysql	procs_priv	Db	char	64	192	utf8	utf8_bin	char(64)
 3.0000	mysql	procs_priv	User	char	16	48	utf8	utf8_bin	char(16)
-3.0000	mysql	procs_priv	Routine_name	char	64	192	utf8	utf8_bin	char(64)
+3.0000	mysql	procs_priv	Routine_name	char	64	192	utf8	utf8_general_ci	char(64)
 3.0000	mysql	procs_priv	Routine_type	enum	9	27	utf8	utf8_bin	enum('FUNCTION','PROCEDURE')
 3.0000	mysql	procs_priv	Grantor	char	77	231	utf8	utf8_bin	char(77)
 3.0000	mysql	procs_priv	Proc_priv	set	27	81	utf8	utf8_general_ci	set('Execute','Alter Routine','Grant')

mysql-test/suite/rpl/r/rpl_stop_slave.result

@@ -146,6 +146,7 @@ DROP TABLE t1, t2;
 CREATE TABLE t1 (c1 INT KEY, c2 INT) ENGINE=InnoDB;
 CREATE TABLE t2 (c1 INT) ENGINE=MyISAM;
 INSERT INTO t1 VALUES(1, 1);
+[connection master]
 SET GLOBAL debug= 'd,dump_thread_wait_before_send_xid';
 [connection slave]
 include/restart_slave.inc

mysql-test/suite/rpl/t/rpl_stop_slave.test

@@ -76,11 +76,13 @@ CREATE TABLE t1 (c1 INT KEY, c2 INT) ENGINE=InnoDB;
 CREATE TABLE t2 (c1 INT) ENGINE=MyISAM;
 INSERT INTO t1 VALUES(1, 1);
 
+sync_slave_with_master;
+
+--source include/rpl_connection_master.inc
+
 let $debug_save= `SELECT @@GLOBAL.debug`;
 SET GLOBAL debug= 'd,dump_thread_wait_before_send_xid';
 
-sync_slave_with_master;
-
 --source include/rpl_connection_slave.inc
 source include/restart_slave_sql.inc;
 

mysql-test/t/analyse.test

@@ -133,3 +133,15 @@ DROP TABLE t1;
 
 
 --echo End of 5.0 tests
+
+--echo #
+--echo # Bug#11765202: Dbug_violation_helper::~Dbug_violation_helper(): Assertion `!_entered' failed.
+--echo #
+
+DROP TABLE IF EXISTS t1;
+CREATE TABLE t1 (a VARCHAR(2) CHARSET UTF8 NOT NULL);
+INSERT INTO t1 VALUES ('e'),('e'),('e-');
+SELECT * FROM t1 PROCEDURE ANALYSE();
+DROP TABLE t1;
+
+--echo End of 5.1 tests

mysql-test/t/events_bugs.test

@@ -1221,6 +1221,21 @@ SELECT event_name, originator FROM INFORMATION_SCHEMA.EVENTS;
 DROP EVENT ev1;
 SET GLOBAL server_id = @old_server_id;
 
+#
+# Bug#11751148: show events shows events in other schema
+#
+
+CREATE DATABASE event_test1;
+USE event_test1;
+CREATE EVENT ev1 ON SCHEDULE EVERY 1 DAY DO SELECT 1;
+CREATE DATABASE event_test2;
+USE event_test2;
+# Following show events should not show ev1
+SHOW EVENTS;
+DROP DATABASE event_test1;
+DROP DATABASE event_test2;
+
+
 ###########################################################################
 #
 # End of tests

mysql-test/t/mysqldump.test

@@ -2193,6 +2193,8 @@ ALTER DATABASE `test-database` CHARACTER SET utf8 COLLATE utf8_unicode_ci ;
 --exec $MYSQL_DUMP --quote-names --compact test-database
 
 DROP DATABASE `test-database`;
+# Switching back to test database.
+USE `test`;
 
 --echo #
 --echo # End of 5.1 tests

mysql-test/t/ssl_cipher-master.opt

+--ssl-cipher=AES128-SHA

mysql-test/t/ssl_cipher.test

+# Turn on ssl between the client and server
+# and run a number of tests
+
+--echo #
+--echo # BUG#11760210 - SSL_CIPHER_LIST NOT SET OR RETURNED FOR "SHOW STATUS LIKE 'SSL_CIPHER_LIST'"
+--echo #
+
+-- source include/have_ssl.inc
+
+# Save the initial number of concurrent sessions
+--source include/count_sessions.inc
+
+connect (ssl_con,localhost,root,,,,,SSL);
+
+# Check Cipher Name and Cipher List
+SHOW STATUS LIKE 'Ssl_cipher';
+SHOW STATUS LIKE 'Ssl_cipher_list';
+
+connection default;
+disconnect ssl_con;
+
+# Wait till all disconnects are completed
+--source include/wait_until_count_sessions.inc

mysql-test/t/variables.test

@@ -1293,6 +1293,11 @@ SET @@global.max_join_size=0;
 SET @@global.key_buffer_size=0;
 SET @@global.key_cache_block_size=0;
 
+#
+# Bug#56976: added new start-up parameter
+#
+select @@max_long_data_size;
+
 # cleanup
 SET @@global.max_binlog_cache_size=DEFAULT;
 SET @@global.max_join_size=DEFAULT;

plugin/fulltext/plugin_example.c

-/* Copyright (C) 2006 MySQL AB
+/* Copyright (c) 2006, 2011, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -259,7 +259,7 @@ mysql_declare_plugin(ftexample)
   MYSQL_FTPARSER_PLUGIN,      /* type                            */
   &simple_parser_descriptor,  /* descriptor                      */
   "simple_parser",            /* name                            */
-  "MySQL AB",                 /* author                          */
+  "Oracle Corp",              /* author                          */
   "Simple Full-Text Parser",  /* description                     */
   PLUGIN_LICENSE_GPL,
   simple_parser_plugin_init,  /* init function (when loaded)     */

sql/event_db_repository.cc

@@ -424,7 +424,7 @@ Event_db_repository::index_read_for_db_for_i_s(THD *thd, TABLE *schema_table,
   key_copy(key_buf, event_table->record[0], key_info, key_len);
   if (!(ret= event_table->file->index_read_map(event_table->record[0], key_buf,
                                                (key_part_map)1,
-                                               HA_READ_PREFIX)))
+                                               HA_READ_KEY_EXACT)))
   {
     DBUG_PRINT("info",("Found rows. Let's retrieve them. ret=%d", ret));
     do

sql/item.cc

@@ -2742,6 +2742,16 @@ bool Item_param::set_longdata(const char *str, ulong length)
     (here), and first have to concatenate all pieces together,
     write query to the binary log and only then perform conversion.
   */
+  if (str_value.length() + length > max_long_data_size)
+  {
+    my_message(ER_UNKNOWN_ERROR,
+               "Parameter of prepared statement which is set through "
+               "mysql_send_long_data() is longer than "
+               "'max_long_data_size' bytes",
+               MYF(0));
+    DBUG_RETURN(true);
+  }
+
   if (str_value.append(str, length, &my_charset_bin))
     DBUG_RETURN(TRUE);
   state= LONG_DATA_VALUE;

sql/mysql_priv.h

@@ -1965,6 +1965,7 @@ extern my_bool relay_log_purge, opt_innodb_safe_binlog, opt_innodb;
 extern uint test_flags,select_errors,ha_open_options;
 extern uint protocol_version, mysqld_port, dropping_tables;
 extern uint delay_key_write_options;
+extern ulong max_long_data_size;
 #endif /* MYSQL_SERVER */
 #if defined MYSQL_SERVER || defined INNODB_COMPATIBILITY_HOOKS
 extern MYSQL_PLUGIN_IMPORT uint lower_case_table_names;

sql/mysqld.cc

@@ -409,6 +409,7 @@ TYPELIB log_output_typelib= {array_elements(log_output_names)-1,"",
 
 /* the default log output is log tables */
 static bool lower_case_table_names_used= 0;
+static bool max_long_data_size_used= false;
 static bool volatile select_thread_in_use, signal_thread_in_use;
 static bool volatile ready_to_exit;
 static my_bool opt_debugging= 0, opt_external_locking= 0, opt_console= 0;
@@ -574,6 +575,11 @@ ulong delayed_insert_errors,flush_time;
 ulong specialflag=0;
 ulong binlog_cache_use= 0, binlog_cache_disk_use= 0;
 ulong max_connections, max_connect_errors;
+/*
+  Maximum length of parameter value which can be set through
+  mysql_send_long_data() call.
+*/
+ulong max_long_data_size;
 uint  max_user_connections= 0;
 /**
   Limit of the total number of prepared statements in the server.
@@ -5800,7 +5806,8 @@ enum options_mysqld
   OPT_SLOW_QUERY_LOG_FILE,
   OPT_IGNORE_BUILTIN_INNODB,
   OPT_BINLOG_DIRECT_NON_TRANS_UPDATE,
-  OPT_DEFAULT_CHARACTER_SET_OLD
+  OPT_DEFAULT_CHARACTER_SET_OLD,
+  OPT_MAX_LONG_DATA_SIZE
 };
 
 
@@ -6880,6 +6887,13 @@ thread is in the relay logs.",
     &global_system_variables.max_length_for_sort_data,
     &max_system_variables.max_length_for_sort_data, 0, GET_ULONG,
     REQUIRED_ARG, 1024, 4, 8192*1024L, 0, 1, 0},
+  {"max_long_data_size", OPT_MAX_LONG_DATA_SIZE,
+   "The maximum size of prepared statement parameter which can be provided "
+   "through mysql_send_long_data() API call. "
+   "Deprecated option; use max_allowed_packet instead.",
+   &max_long_data_size,
+   &max_long_data_size, 0, GET_ULONG,
+   REQUIRED_ARG, 1024*1024L, 1024, UINT_MAX32, MALLOC_OVERHEAD, 1, 0},
   {"max_prepared_stmt_count", OPT_MAX_PREPARED_STMT_COUNT,
    "Maximum number of prepared statements in the server.",
    &max_prepared_stmt_count, &max_prepared_stmt_count,
@@ -8688,6 +8702,10 @@ mysqld_get_one_option(int optid,
     }
     break;
 #endif /* defined(ENABLED_DEBUG_SYNC) */
+  case OPT_MAX_LONG_DATA_SIZE:
+    max_long_data_size_used= true;
+    WARN_DEPRECATED(NULL, VER_CELOSIA, "--max_long_data_size", "--max_allowed_packet");
+    break;
   }
   return 0;
 }
@@ -8849,6 +8867,14 @@ static int get_options(int *argc,char **argv)
   else
     pool_of_threads_scheduler(&thread_scheduler);  /* purecov: tested */
 #endif
+
+  /*
+    If max_long_data_size is not specified explicitly use
+    value of max_allowed_packet.
+  */
+  if (!max_long_data_size_used)
+    max_long_data_size= global_system_variables.max_allowed_packet;
+
   return 0;
 }
 

sql/set_var.cc

@@ -394,6 +394,12 @@ static sys_var_thd_ulong	sys_max_seeks_for_key(&vars, "max_seeks_for_key",
 					      &SV::max_seeks_for_key);
 static sys_var_thd_ulong   sys_max_length_for_sort_data(&vars, "max_length_for_sort_data",
                                                  &SV::max_length_for_sort_data);
+static sys_var_const    sys_max_long_data_size(&vars,
+                                               "max_long_data_size",
+                                               OPT_GLOBAL, SHOW_LONG,
+                                               (uchar*)
+                                               &max_long_data_size);
+
 #ifndef TO_BE_DELETED	/* Alias for max_join_size */
 static sys_var_thd_ha_rows	sys_sql_max_join_size(&vars, "sql_max_join_size",
 					      &SV::max_join_size,

sql/sql_analyse.cc

@@ -242,7 +242,7 @@ bool test_if_number(NUM_INFO *info, const char *str, uint str_len)
       if (str == end)
       {
 	info->is_float = 1;             // we can't use variable decimals here
-	return 1;
+	DBUG_RETURN(1);
       }
       DBUG_RETURN(0);
     }

sql/sql_prepare.cc

@@ -2730,6 +2730,32 @@ void mysql_sql_stmt_close(THD *thd)
   }
 }
 
+
+class Set_longdata_error_handler : public Internal_error_handler
+{
+public:
+  Set_longdata_error_handler(Prepared_statement *statement)
+    : stmt(statement)
+  { }
+
+public:
+  bool handle_error(uint sql_errno,
+                    const char *message,
+                    MYSQL_ERROR::enum_warning_level level,
+                    THD *)
+  {
+    stmt->state= Query_arena::ERROR;
+    stmt->last_errno= sql_errno;
+    strncpy(stmt->last_error, message, MYSQL_ERRMSG_SIZE);
+
+    return TRUE;
+  }
+
+private:
+  Prepared_statement *stmt;
+};
+
+
 /**
   Handle long data in pieces from client.
 
@@ -2786,16 +2812,19 @@ void mysql_stmt_get_longdata(THD *thd, char *packet, ulong packet_length)
 
   param= stmt->param_array[param_number];
 
+  Set_longdata_error_handler err_handler(stmt);
+  /*
+    Install handler that will catch any errors that can be generated
+    during execution of Item_param::set_longdata() and propagate
+    them to Statement::last_error.
+  */
+  thd->push_internal_handler(&err_handler);
 #ifndef EMBEDDED_LIBRARY
-  if (param->set_longdata(packet, (ulong) (packet_end - packet)))
+  param->set_longdata(packet, (ulong) (packet_end - packet));
 #else
-  if (param->set_longdata(thd->extra_data, thd->extra_length))
+  param->set_longdata(thd->extra_data, thd->extra_length);
 #endif
-  {
-    stmt->state= Query_arena::ERROR;
-    stmt->last_errno= ER_OUTOFMEMORY;
-    sprintf(stmt->last_error, ER(ER_OUTOFMEMORY), 0);
-  }
+  thd->pop_internal_handler();
 
   general_log_print(thd, thd->command, NullS);
 
@@ -3257,6 +3286,13 @@ Prepared_statement::execute_loop(String *expanded_query,
   bool error;
   int reprepare_attempt= 0;
 
+  /* Check if we got an error when sending long data */
+  if (state == Query_arena::ERROR)
+  {
+    my_message(last_errno, last_error, MYF(0));
+    return TRUE;
+  }
+
   if (set_parameters(expanded_query, packet, packet_end))
     return TRUE;
 
@@ -3497,12 +3533,6 @@ bool Prepared_statement::execute(String *expanded_query, bool open_cursor)
 
   status_var_increment(thd->status_var.com_stmt_execute);
 
-  /* Check if we got an error when sending long data */
-  if (state == Query_arena::ERROR)
-  {
-    my_message(last_errno, last_error, MYF(0));
-    return TRUE;
-  }
   if (flags & (uint) IS_IN_USE)
   {
     my_error(ER_PS_NO_RECURSION, MYF(0));

tests/mysql_client_test.c

@@ -18464,6 +18464,56 @@ static void test_bug58036()
 }
 
 
+/*
+  Bug #56976:   Severe Denial Of Service in prepared statements
+*/
+static void test_bug56976()
+{
+  MYSQL_STMT   *stmt;
+  MYSQL_BIND    bind[1];
+  int           rc;
+  const char*   query = "SELECT LENGTH(?)";
+  char *long_buffer;
+  unsigned long i, packet_len = 256 * 1024L;
+  unsigned long dos_len    = 2 * 1024 * 1024L;
+
+  DBUG_ENTER("test_bug56976");
+  myheader("test_bug56976");
+
+  stmt= mysql_stmt_init(mysql);
+  check_stmt(stmt);
+
+  rc= mysql_stmt_prepare(stmt, query, strlen(query));
+  check_execute(stmt, rc);
+
+  memset(bind, 0, sizeof(bind));
+  bind[0].buffer_type = MYSQL_TYPE_TINY_BLOB;
+
+  rc= mysql_stmt_bind_param(stmt, bind);
+  check_execute(stmt, rc);
+
+  long_buffer= (char*) my_malloc(packet_len, MYF(0));
+  DIE_UNLESS(long_buffer);
+
+  memset(long_buffer, 'a', packet_len);
+
+  for (i= 0; i < dos_len / packet_len; i++)
+  {
+    rc= mysql_stmt_send_long_data(stmt, 0, long_buffer, packet_len);
+    check_execute(stmt, rc);
+  }
+
+  my_free(long_buffer, MYF(0));
+  rc= mysql_stmt_execute(stmt);
+
+  DIE_UNLESS(rc && mysql_stmt_errno(stmt) == ER_UNKNOWN_ERROR);
+
+  mysql_stmt_close(stmt);
+
+  DBUG_VOID_RETURN;
+}
+
+
 /*
   Read and parse arguments and MySQL options from my.cnf
 */
@@ -18791,6 +18841,7 @@ static struct my_tests_st my_tests[]= {
   { "test_bug54041", test_bug54041 },
   { "test_bug47485", test_bug47485 },
   { "test_bug58036", test_bug58036 },
+  { "test_bug56976", test_bug56976 },
   { 0, 0 }
 };