1. 26 Aug, 2008 1 commit
  2. 25 Aug, 2008 2 commits
  3. 22 Aug, 2008 1 commit
    • Alexey Botchkov's avatar
      Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY. · 69657f97
      Alexey Botchkov authored
                  
                  test_if_data_home_dir fixed to look into real path.
                  Checks added to mi_open for symlinks into data home directory.
      
      per-file messages:
              include/my_sys.h
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                my_is_symlink interface added
              include/myisam.h
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                myisam_test_invalid_symlink interface added
              myisam/mi_check.c
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                mi_open_datafile calls modified
              myisam/mi_open.c
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                code added to mi_open to check for symlinks into data home directory.
                mi_open_datafile now accepts 'original' file path to check if it's
                an allowed symlink.
              myisam/mi_static.c
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                myisam_test_invlaid_symlink defined
              myisam/myisamchk.c
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                mi_open_datafile call modified
              myisam/myisamdef.h
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                mi_open_datafile interface modified - 'real_path' parameter added
              mysql-test/r/symlink.test
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                error codes corrected as some patch now rejected pointing inside datahome
              mysql-test/r/symlink.result
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                error messages corrected in the result
              mysys/my_symlink.c
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                my_is_symlink() implementsd
                my_realpath() now returns the 'realpath' even if a file isn't a symlink
              sql/mysql_priv.h
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                test_if_data_home_dir interface
              sql/mysqld.cc
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                myisam_test_invalid_symlik set with the 'test_if_data_home_dir'
              sql/sql_parse.cc
                Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
                
                error messages corrected
                test_if_data_home_dir code fixed
      69657f97
  4. 20 Aug, 2008 1 commit
    • Sergey Glukhov's avatar
      Bug#38291 memory corruption and server crash with view/sp/function · 9bc9ddd5
      Sergey Glukhov authored
      Send_field.org_col_name has broken value on secondary execution.
      It happens when result field is created from the field which belongs to view
      due to forgotten assignment of some Send_field attributes. 
      The fix:
      set Send_field.org_col_name,org_table_name with correct value during Send_field intialization.
      9bc9ddd5
  5. 19 Aug, 2008 2 commits
  6. 18 Aug, 2008 4 commits
  7. 15 Aug, 2008 4 commits
  8. 14 Aug, 2008 1 commit
  9. 13 Aug, 2008 4 commits
  10. 12 Aug, 2008 2 commits
  11. 11 Aug, 2008 9 commits
    • Davi Arnaut's avatar
      Bug#38486: Crash when using cursor protocol · d5620961
      Davi Arnaut authored
      Post-merge fix: mysql_client_test.c is compiled by C compilers
      and some C compilers don't support mixed declarations and code
      and it's explicitly forbidden by ISO C90.
      d5620961
    • Marc Alff's avatar
      Merge mysql-5.0-bugteam -> local bugfix branch · e087c05d
      Marc Alff authored
      e087c05d
    • Marc Alff's avatar
      Bug#37302 (missing DBUG_RETURN macro in function "find_key_block" (5.0 only)) · fd324dd3
      Marc Alff authored
      Fixed missing DBUG_RETURN in the function find_key_block
      fd324dd3
    • Chad MILLER's avatar
      Merge from bugteam 5.0 trunk. · 318d288a
      Chad MILLER authored
      318d288a
    • Marc Alff's avatar
      Bug#38296 (low memory crash with many conditions in a query) · 394691cd
      Marc Alff authored
      This fix is for 5.0 only : back porting the 6.0 patch manually
      
      The parser code in sql/sql_yacc.yy needs to be more robust to out of
      memory conditions, so that when parsing a query fails due to OOM,
      the thread gracefully returns an error.
      
      Before this fix, a new/alloc returning NULL could:
      - cause a crash, if dereferencing the NULL pointer,
      - produce a corrupted parsed tree, containing NULL nodes,
      - alter the semantic of a query, by silently dropping token values or nodes
      
      With this fix:
      - C++ constructors are *not* executed with a NULL "this" pointer
      when operator new fails.
      This is achieved by declaring "operator new" with a "throw ()" clause,
      so that a failed new gracefully returns NULL on OOM conditions.
      
      - calls to new/alloc are tested for a NULL result,
      
      - The thread diagnostic area is set to an error status when OOM occurs.
      This ensures that a request failing in the server properly returns an
      ER_OUT_OF_RESOURCES error to the client.
      
      - OOM conditions cause the parser to stop immediately (MYSQL_YYABORT).
      This prevents causing further crashes when using a partially built parsed
      tree in further rules in the parser.
      
      No test scripts are provided, since automating OOM failures is not
      instrumented in the server.
      Tested under the debugger, to verify that an error in alloc_root cause the
      thread to returns gracefully all the way to the client application, with
      an ER_OUT_OF_RESOURCES error.
      394691cd
    • Chad MILLER's avatar
      fe39a901
    • Davi Arnaut's avatar
      bafa07b2
    • Kristofer Pettersson's avatar
      Automerge · a3b0b7bb
      Kristofer Pettersson authored
      a3b0b7bb
    • Kristofer Pettersson's avatar
      Bug#38486 Crash when using cursor protocol · 9fc39adf
      Kristofer Pettersson authored
                  
      Server side cursors were not initialized properly and this caused a reference to
      uninitialized memory.
      9fc39adf
  12. 08 Aug, 2008 1 commit
    • Timothy Smith's avatar
      Cherry-pick fix for Bug#35220 from innodb-5.0-ss2475 snapshot. · 4ea036f4
      Timothy Smith authored
      Bug#35220: ALTER TABLE too picky on reserved word "foreign"
      
      In ALTER TABLE, change the internal parser to search for
      ``FOREIGN[[:space:]]'' instead of only ``FOREIGN'' when parsing
      ALTER TABLE ... DROP FOREIGN KEY ...; otherwise it could be mistaken
      with ALTER TABLE ... DROP foreign_col;
      
      (This fix is already present in MySQL 5.1 and higher.)
      4ea036f4
  13. 07 Aug, 2008 1 commit
    • Chad MILLER's avatar
      Bug#31605: mysql_upgrade relies on Linux /proc filesystem when not \ · 6c93f05a
      Chad MILLER authored
      	running on Windows
      
      We used two OS-specific methods of looking up the executable 
      name, which don't work outside of those two kinds of OSes 
      (Linux+Solaris and Windows).
      
      We assume that if the user ran this program with a certain 
      name, we can run the other sibling programs with a similar name.
      
      (re-patch in bzr)
      6c93f05a
  14. 06 Aug, 2008 3 commits
  15. 04 Aug, 2008 1 commit
  16. 31 Jul, 2008 2 commits
    • Timothy Smith's avatar
      Cherry-pick InnoDB fixes for Bug#34286, Bug#35352, and Bug#36600 from snapshot · 021d7d72
      Timothy Smith authored
      innodb-5.0-ss2475.
      
      Bug #34286  Assertion failure in thread 2816 in file .\row\row0sel.c line 3500
      Since autoinc init performs a MySQL SELECT query to determine the auto-inc
      value, set prebuilt->sql_stat_start = TRUE so that it is performed like any
      normal SELECT, regardless of the context in which it was invoked.
      
      
      Bug #35352  If InnoDB crashes with UNDO slots full error the error persists on restart
      We've added a heuristic that checks the size of the UNDO slots cache lists
      (insert and upate). If either of cached lists has more than 500 entries then we
      add any UNDO slots that are freed, to the common free list instead of the cache
      list, this is to avoid the case where all the free slots end up in only one of
      the lists on startup after a crash.
      
      Tested with test case for 26590 and passes all mysql-test(s).
      
      Bug #36600  SHOW STATUS takes a lot of CPU in buf_get_latched_pages_number
      Fixed by removing the Innodb_buffer_pool_pages_latched variable from SHOW
      STATUS output in non-UNIV_DEBUG compilation.
      021d7d72
    • Georgi Kodinov's avatar
      Bug#34159: mysql_install_db fails with sql_mode=TRADITIONAL · a0768d32
      Georgi Kodinov authored
            
      Reset session sql_mode before creating system tables as it
      is done in the mysql_fix_privilege_tables.sql script.
      a0768d32
  17. 30 Jul, 2008 1 commit
    • Georgi Kodinov's avatar
      Bug#37662 nested if() inside sum() is parsed in exponential time · 425abb49
      Georgi Kodinov authored
            
      min() and max() functions are implemented in MySQL as macros.
      This means that max(a,b) is expanded to: ((a) > (b) ? (a) : (b))
      Note how 'a' is quoted two times.
      Now imagine 'a' is a recursive function call that's several 10s of levels deep.
      And the recursive function does max() with a function arg as well to dive into
      recursion.
      This means that simple function call can take most of the clock time.
      Identified and fixed several such calls to max()/min() : including the IF() 
      sql function implementation.
      425abb49