Merge bk-internal.mysql.com:/home/bk/mysql-5.1-bugteam

into  amd64.(none):/src/bug26243/my51-bug26243

mysql-test/r/loaddata.result

@@ -261,6 +261,82 @@ SELECT * FROM t1;
 c1	c2	c3	c4
 10	1970-02-01 01:02:03	1.1e-100	1.1e+100
 DROP TABLE t1;
+
+# --
+# -- Bug#35469: server crash with LOAD DATA INFILE to a VIEW.
+# --
+
+DROP TABLE IF EXISTS t1;
+DROP VIEW IF EXISTS v1;
+DROP VIEW IF EXISTS v2;
+DROP VIEW IF EXISTS v3;
+
+CREATE TABLE t1(c1 INT, c2 VARCHAR(255));
+
+CREATE VIEW v1 AS SELECT * FROM t1;
+CREATE VIEW v2 AS SELECT 1 + 2 AS c0, c1, c2 FROM t1;
+CREATE VIEW v3 AS SELECT 1 AS d1, 2 AS d2;
+
+LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v1
+FIELDS ESCAPED BY '\\'
+  TERMINATED BY ','
+  ENCLOSED BY '"'
+  LINES TERMINATED BY '\n' (c1, c2);
+
+SELECT * FROM t1;
+c1	c2
+1	 "string1"
+2	 "string2"
+3	 "string3"
+
+SELECT * FROM v1;
+c1	c2
+1	 "string1"
+2	 "string2"
+3	 "string3"
+
+DELETE FROM t1;
+
+LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v2
+FIELDS ESCAPED BY '\\'
+  TERMINATED BY ','
+  ENCLOSED BY '"'
+  LINES TERMINATED BY '\n' (c1, c2);
+
+SELECT * FROM t1;
+c1	c2
+1	 "string1"
+2	 "string2"
+3	 "string3"
+
+SELECT * FROM v2;
+c0	c1	c2
+3	1	 "string1"
+3	2	 "string2"
+3	3	 "string3"
+
+DELETE FROM t1;
+
+LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v2
+FIELDS ESCAPED BY '\\'
+  TERMINATED BY ','
+  ENCLOSED BY '"'
+  LINES TERMINATED BY '\n' (c0, c2);
+ERROR HY000: Invalid column reference (v2.c0) in LOAD DATA
+
+LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v3
+FIELDS ESCAPED BY '\\'
+  TERMINATED BY ','
+  ENCLOSED BY '"'
+  LINES TERMINATED BY '\n' (d1, d2);
+ERROR HY000: The target table v3 of the LOAD is not updatable
+
+DROP TABLE t1;
+DROP VIEW v1;
+DROP VIEW v2;
+DROP VIEW v3;
+
+# -- End of Bug#35469.
 CREATE TABLE t1 (a int);
 INSERT INTO t1 VALUES (1);
 SET NAMES latin1;

mysql-test/std_data/bug35469.dat

+"1", "string1"
+"2", "string2"
+"3", "string3"

mysql-test/t/loaddata.test

@@ -240,6 +240,88 @@ SELECT * FROM t1;
 remove_file $MYSQLTEST_VARDIR/tmp/t1;
 DROP TABLE t1;
 
+###########################################################################
+
+--echo
+--echo # --
+--echo # -- Bug#35469: server crash with LOAD DATA INFILE to a VIEW.
+--echo # --
+
+--echo
+--disable_warnings
+DROP TABLE IF EXISTS t1;
+DROP VIEW IF EXISTS v1;
+DROP VIEW IF EXISTS v2;
+DROP VIEW IF EXISTS v3;
+--enable_warnings
+
+--echo
+CREATE TABLE t1(c1 INT, c2 VARCHAR(255));
+
+--echo
+CREATE VIEW v1 AS SELECT * FROM t1;
+CREATE VIEW v2 AS SELECT 1 + 2 AS c0, c1, c2 FROM t1;
+CREATE VIEW v3 AS SELECT 1 AS d1, 2 AS d2;
+
+--echo
+LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v1
+  FIELDS ESCAPED BY '\\'
+  TERMINATED BY ','
+  ENCLOSED BY '"'
+  LINES TERMINATED BY '\n' (c1, c2);
+
+--echo
+SELECT * FROM t1;
+
+--echo
+SELECT * FROM v1;
+
+--echo
+DELETE FROM t1;
+
+--echo
+LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v2
+  FIELDS ESCAPED BY '\\'
+  TERMINATED BY ','
+  ENCLOSED BY '"'
+  LINES TERMINATED BY '\n' (c1, c2);
+
+--echo
+SELECT * FROM t1;
+
+--echo
+SELECT * FROM v2;
+
+--echo
+DELETE FROM t1;
+
+--echo
+--error ER_LOAD_DATA_INVALID_COLUMN
+LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v2
+  FIELDS ESCAPED BY '\\'
+  TERMINATED BY ','
+  ENCLOSED BY '"'
+  LINES TERMINATED BY '\n' (c0, c2);
+
+--echo
+--error ER_NON_UPDATABLE_TABLE
+LOAD DATA INFILE '../std_data_ln/bug35469.dat' INTO TABLE v3
+  FIELDS ESCAPED BY '\\'
+  TERMINATED BY ','
+  ENCLOSED BY '"'
+  LINES TERMINATED BY '\n' (d1, d2);
+
+--echo
+DROP TABLE t1;
+DROP VIEW v1;
+DROP VIEW v2;
+DROP VIEW v3;
+
+--echo
+--echo # -- End of Bug#35469.
+
+###########################################################################
+
 # End of 5.0 tests
 
 

sql/share/errmsg.txt

@@ -6120,3 +6120,6 @@ ER_NO_FORMAT_DESCRIPTION_EVENT_BEFORE_BINLOG_STATEMENT
   eng "The BINLOG statement of type `%s` was not preceded by a format description BINLOG statement."
 ER_SLAVE_CORRUPT_EVENT
   eng "Corrupted replication event was detected"
+
+ER_LOAD_DATA_INVALID_COLUMN
+  eng "Invalid column reference (%-.64s) in LOAD DATA"

sql/sql_load.cc

@@ -237,9 +237,11 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list,
 
   while ((item= it++))
   {
-    if (item->type() == Item::FIELD_ITEM)
+    Item *real_item= item->real_item();
+
+    if (real_item->type() == Item::FIELD_ITEM)
     {
-      Field *field= ((Item_field*)item)->field;
+      Field *field= ((Item_field*)real_item)->field;
       if (field->flags & BLOB_FLAG)
       {
         use_blobs= 1;
@@ -248,7 +250,7 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list,
       else
         tot_length+= field->field_length;
     }
-    else
+    else if (item->type() == Item::STRING_ITEM)
       use_vars= 1;
   }
   if (use_blobs && !ex->line_term->length() && !field_term->length())
@@ -706,6 +708,7 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list,
     {
       uint length;
       uchar *pos;
+      Item *real_item;
 
       if (read_info.read_field())
 	break;
@@ -717,14 +720,17 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list,
       pos=read_info.row_start;
       length=(uint) (read_info.row_end-pos);
 
+      real_item= item->real_item();
+
       if (!read_info.enclosed &&
 	  (enclosed_length && length == 4 &&
            !memcmp(pos, STRING_WITH_LEN("NULL"))) ||
 	  (length == 1 && read_info.found_null))
       {
-        if (item->type() == Item::FIELD_ITEM)
+
+        if (real_item->type() == Item::FIELD_ITEM)
         {
-          Field *field= ((Item_field *)item)->field;
+          Field *field= ((Item_field *)real_item)->field;
           if (field->reset())
           {
             my_error(ER_WARN_NULL_TO_NOTNULL, MYF(0), field->field_name,
@@ -741,26 +747,40 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list,
                                  ER_WARN_NULL_TO_NOTNULL, 1);
           }
 	}
-        else
+        else if (item->type() == Item::STRING_ITEM)
+        {
           ((Item_user_var_as_out_param *)item)->set_null_value(
                                                   read_info.read_charset);
+        }
+        else
+        {
+          my_error(ER_LOAD_DATA_INVALID_COLUMN, MYF(0), item->full_name());
+          DBUG_RETURN(1);
+        }
+
 	continue;
       }
 
-      if (item->type() == Item::FIELD_ITEM)
+      if (real_item->type() == Item::FIELD_ITEM)
       {
-
-        Field *field= ((Item_field *)item)->field;
+        Field *field= ((Item_field *)real_item)->field;
         field->set_notnull();
         read_info.row_end[0]=0;			// Safe to change end marker
         if (field == table->next_number_field)
           table->auto_increment_field_not_null= TRUE;
         field->store((char*) pos, length, read_info.read_charset);
       }
-      else
+      else if (item->type() == Item::STRING_ITEM)
+      {
         ((Item_user_var_as_out_param *)item)->set_value((char*) pos, length,
                                                         read_info.read_charset);
       }
+      else
+      {
+        my_error(ER_LOAD_DATA_INVALID_COLUMN, MYF(0), item->full_name());
+        DBUG_RETURN(1);
+      }
+    }
     if (read_info.error)
       break;
     if (skip_lines)
@@ -775,9 +795,10 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list,
 	break;
       for (; item ; item= it++)
       {
-        if (item->type() == Item::FIELD_ITEM)
+        Item *real_item= item->real_item();
+        if (real_item->type() == Item::FIELD_ITEM)
         {
-          Field *field= ((Item_field *)item)->field;
+          Field *field= ((Item_field *)real_item)->field;
           if (field->reset())
           {
             my_error(ER_WARN_NULL_TO_NOTNULL, MYF(0),field->field_name,
@@ -797,10 +818,17 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list,
                               ER_WARN_TOO_FEW_RECORDS,
                               ER(ER_WARN_TOO_FEW_RECORDS), thd->row_count);
         }
-        else
+        else if (item->type() == Item::STRING_ITEM)
+        {
           ((Item_user_var_as_out_param *)item)->set_null_value(
                                                   read_info.read_charset);
         }
+        else
+        {
+          my_error(ER_LOAD_DATA_INVALID_COLUMN, MYF(0), item->full_name());
+          DBUG_RETURN(1);
+        }
+      }
     }
 
     if (thd->killed ||