Bug#8351

Fix for crash when using a double quote in boolean fulltext query.


mysql-test/r/fulltext.result:
  Added a test case for bug #8351.
mysql-test/t/fulltext.test:
  Added a test case for bug #8351.
BitKeeper/etc/logging_ok:
  Logging to logging@openlogging.org accepted

BitKeeper/etc/logging_ok

@@ -203,6 +203,7 @@ serg@sergbook.mysql.com
 sergefp@mysql.com
 sinisa@rhols221.adsl.netsonic.fi
 stewart@mysql.com
+svoj@mysql.com
 tfr@beta.frontier86.ee
 tfr@indrek.tfr.cafe.ee
 tfr@sarvik.tfr.cafe.ee

myisam/ft_boolean_search.c

@@ -435,32 +435,24 @@ static int _ftb_strstr(const byte *s0, const byte *e0,
                 const byte *s1, const byte *e1,
                 CHARSET_INFO *cs)
 {
-  const byte *p0, *p1;
-  my_bool s_after, e_before;
-
-  s_after=true_word_char(cs, s1[0]);
-  e_before=true_word_char(cs, e1[-1]);
-  p0=s0;
+  const byte *p0= s0;
+  my_bool s_after= true_word_char(cs, s1[0]);
+  my_bool e_before= true_word_char(cs, e1[-1]);
+  uint p0_len;
+  my_match_t m[2];
 
   while (p0 < e0)
   {
-    while (p0 < e0 && cs->to_upper[(uint) (uchar) *p0++] !=
-           cs->to_upper[(uint) (uchar) *s1])
-      /* no-op */;
-    if (p0 >= e0)
-      return 0;
-
-    if (s_after && p0-1 > s0 && true_word_char(cs, p0[-2]))
-      continue;
-
-    p1=s1+1;
-    while (p0 < e0 && p1 < e1 && cs->to_upper[(uint) (uchar) *p0] ==
-           cs->to_upper[(uint) (uchar) *p1])
-      p0++, p1++;
-    if (p1 == e1 && (!e_before || p0 == e0 || !true_word_char(cs, p0[0])))
-      return 1;
+    if (cs->coll->instr(cs, p0, e0 - p0, s1, e1 - s1, m, 2) != 2)
+      return(0);
+    if ((!s_after || p0 + m[1].beg == s0 || !true_word_char(cs, p0[m[1].beg-1])) &&
+        (!e_before || p0 + m[1].end == e0 || !true_word_char(cs, p0[m[1].end])))
+      return(1);
+    p0+= m[1].beg;
+    p0+= (p0_len= my_mbcharlen(cs, *(uchar *)p0)) ? p0_len : 1;
   }
-  return 0;
+
+  return(0);
 }
 
 

mysql-test/r/fulltext.result

@@ -408,3 +408,10 @@ insert t1 values (1, "aaaa"), (2, "bbbb");
 insert t2 values (10, "aaaa"), (2, "cccc");
 replace t1 select * from t2;
 drop table t1, t2;
+CREATE TABLE t1 (t VARCHAR(200) CHARACTER SET utf8 COLLATE utf8_unicode_ci, FULLTEXT (t));
+SET NAMES latin1;
+INSERT INTO t1 VALUES('Mit freundlichem Gr aus Osnabrck');
+SELECT COUNT(*) FROM t1 WHERE MATCH(t) AGAINST ('"osnabrck"' IN BOOLEAN MODE);
+COUNT(*)
+1
+DROP TABLE t1;

mysql-test/t/fulltext.test

@@ -322,3 +322,11 @@ insert t2 values (10, "aaaa"), (2, "cccc");
 replace t1 select * from t2;
 drop table t1, t2;
 
+#
+# bug#8351
+#
+CREATE TABLE t1 (t VARCHAR(200) CHARACTER SET utf8 COLLATE utf8_unicode_ci, FULLTEXT (t));
+SET NAMES latin1;
+INSERT INTO t1 VALUES('Mit freundlichem Gr aus Osnabrck');
+SELECT COUNT(*) FROM t1 WHERE MATCH(t) AGAINST ('"osnabrck"' IN BOOLEAN MODE);
+DROP TABLE t1;