Problem: copying issuer's (or subject's) name tags into an internal
buffer from incoming stream we didn't check the buffer overflow. 
That may lead to memory overrun, crash etc.

Fix: ensure we don't overrun the buffer.

Note: there's no simple test case (exploit needed).


extra/yassl/taocrypt/include/asn.hpp:
  Fix for bug#50227: Pre-auth buffer-overflow in mySQL through yaSSL
    - CertDecoder::AddTag() introduced.
extra/yassl/taocrypt/src/asn.cpp:
  Fix for bug#50227: Pre-auth buffer-overflow in mySQL through yaSSL
    - copying data from incoming stream to the issuer_ or subject_
  buffers ensure we don't overrun them.
    - code cleanup.

- "release" starts from 1
- "level" ("m2", "rc", ...) is included in the RPM version.

but don't take the "tree name" change.

32bit builds with the --enable-assembler flag (enabled by default)
fail with an error message: undefined reference to `strmov_overlapp'.

Since the fix for bug 48866 we use a home-grown strmov function
instead of the ctpcpy function, but the source file for this
function was missed in the Makefile.am.

The strings/Makefile.am file has been modified to include strmov.c
file into ASSEMBLER_x86 and ASSEMBLER_sparc32 sections.


strings/Makefile.am:
  Bug #49955: ld error message: undefined reference to `strmov_overlapp'
  
  The strings/Makefile.am file has been modified to include
  strmov.c file into ASSEMBLER_x86 and ASSEMBLER_sparc32 sections.

Fixed valgrind failure on PB2.

sql/log_event.cc:
  Added code to fix valgrind failure on PB2.

Fixed valgrind failure on PB2.

sql/log_event.cc:
  Added code to fix valgrind failure on PB2.

      
In statement-based or mixed-mode replication, use DROP TEMPORARY TABLE
to drop multiple tables causes different errors on master and slave, 
when one or more of these tables do not exist. Because when executed
on slave, it would automatically add IF EXISTS to the query to ignore
all ER_BAD_TABLE_ERROR errors.

To fix the problem, do not add IF EXISTS when executing DROP TEMPORARY
TABLE on the slave, and clear the ER_BAD_TABLE_ERROR error after
execution if the query does not expect any errors.


mysql-test/r/rpl_drop_temp.result:
  Updated for the patch of bug#49137.
mysql-test/t/rpl_drop_temp.test:
  Added the test file to verify if DROP MULTI TEMPORARY TABLE
  will cause different errors on master and slave, when one or
  more of these tables do not exist.
sql/log_event.cc:
  Added code to handle above cases which are
  removed from sql_parse.cc
sql/sql_parse.cc:
  Remove the code to issue the 'Unknown table' error,
  if the temporary table does not exist when dropping
  it on slave. The above cases decribed in comments
  will be handled later in log_event.cc.

           to make the test run gracefully on windows.

There was also a syntax error in windows part of the test.

on re-execution of prepared statement

Problem: some (see eq_ref_table()) ORDER BY/GROUP BY optimization
is called before each PS execution. However, we don't properly 
initialize its stucture every time before the call.

Fix: properly initialize the sturture used.



mysql-test/r/ps.result:
  Fix for bug#49570: Assertion failed: !(order->used & map) 
  on re-execution of prepared statement
    - test result.
mysql-test/t/ps.test:
  Fix for bug#49570: Assertion failed: !(order->used & map) 
  on re-execution of prepared statement
    - test case.
sql/sql_select.cc:
  Fix for bug#49570: Assertion failed: !(order->used & map) 
  on re-execution of prepared statement
    - set order->used to 0 before each eq_ref_table() call,
  as the function relies on that.

The problem is a somewhat common misusage of the strmake function.
The strmake(dst, src, len) function writes at most /len/ bytes to
the string pointed to by src, not including the trailing null byte.
Hence, if /len/ is the exact length of the destination buffer, a
one byte buffer overflow can occur if the length of the source
string is equal to or greater than /len/.

client/mysqldump.c:
  Make room for the trailing null byte.
libmysql/libmysql.c:
  Add comment, there is enough room in the buffer.
  Increase buffer length, two strings are concatenated.
libmysqld/lib_sql.cc:
  Make room for the trailing null byte.
mysys/default.c:
  Make room for the trailing null bytes.
mysys/mf_pack.c:
  Make room for the trailing null byte.
server-tools/instance-manager/commands.cc:
  Copy only if overflow isn't possible in both cases.
server-tools/instance-manager/listener.cc:
  Make room for the trailing null byte.
sql/log.cc:
  Make room for the trailing null byte.
sql/sp_pcontext.h:
  Cosmetic fix.
sql/sql_acl.cc:
  MAX_HOSTNAME already specifies space for the trailing null byte.
sql/sql_parse.cc:
  Make room for the trailing null byte.
sql/sql_table.cc:
  Make room for the trailing null byte.

The test allowed random coincidence of connection ids for two concurrent
sessions performing CREATE/DROP temp tables.

Fixed with correcting the test. The sessions connection ids are not changed
from their defaults anymore.

                  
When compressed myisam files are opened, they are always memory mapped
sometimes causing memory swapping problems.

When we mmap the myisam compressed tables of size greater than the memory 
available, the kswapd0 process utilization is very high consuming 30-40% of 
the cpu. This happens only with linux kernels older than 2.6.9

With newer linux kernels, we don't have this problem of high cpu consumption
and this option may not be required.
 
The option 'myisam_mmap_size' is added to limit the amount of memory used for
memory mapping of myisam files. This option is not dynamic.

The default value on 32 bit system is 4294967295 bytes and on 64 bit system it
is 18446744073709547520 bytes.

Note: Testcase only tests the option variable. The actual bug has be to 
tested manually.

include/my_global.h:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  define SIZE_T_MAX
include/myisam.h:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  declare 'myisam_mmap_size' and 'myisam_mmap_used' variables and the mutex
  THR_LOCK_myisam_mmap
myisam/mi_packrec.c:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  add 'myisam_mmap_size' option which limits the memory available to mmap of 
  myisam files
myisam/mi_static.c:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  declare 'myisam_mmap_size' and 'myisam_mmap_used' variables and the mutex
  THR_LOCK_myisam_mmap
myisam/myisamdef.h:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  move MEMMAP_EXTRA_MARGIN to myisam.h so that it can be used in mysqld.cc
mysql-test/r/variables.result:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  Testcase for BUG#37408 to test the myisam_mmap_size option
mysql-test/t/variables.test:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  Testcase for BUG#37408 to test the myisam_mmap_size option
mysys/my_thr_init.c:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  intialize the lock THR_LOCK_myisam_mmap
sql/mysqld.cc:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  add the 'myisam_mmap_size' option
sql/set_var.cc:
  Fix for Bug #37408 - Compressed MyISAM files should not require/use mmap()
  
  add the 'myisam_mmap_size' to the SHOW VARIABLES list

Problem: inserting a record we don't set unused null bits in the
record buffer if no default field values used.
That may lead to wrong live checksum calculation.

Fix: set unused null bits in the record buffer in such cases.


mysql-test/r/myisam.result:
  Fix for bug#49465: valgrind warnings and incorrect live checksum...
    - test result.
mysql-test/t/myisam.test:
  Fix for bug#49465: valgrind warnings and incorrect live checksum...
    - test case.
sql/sql_insert.cc:
  Fix for bug#49465: valgrind warnings and incorrect live checksum...
    - set unused null bits to 1 in the record buffer in case we
  don't call restore_record() before a fill_record() call
  (when no default values used).

strmov() is not guaranteed to work correctly on overlapping
source and destination buffers. On some OSes it may work,
but Fedora 12 has a stpcpy() that's not working correctly 
on overlapping buffers.
Fixed to use the overlap-safe version of strmov instead.
Re-vitalized the overlap-safe version of strmov. 

the declaration of THR_LOCK_myisam_mmap in mi_static 
is redundant as it accessible via the extern declaration 
in include/myisam.h

myisam/mi_static.c:
  Bug#49898 - Fix for bug#37408 introduces a linker error
  
  Remove THR_LOCK_myisam_mmap declaration as it is redundant

At the end of execution top level join execution
we cleanup this join with true argument.
It leads to underlying join cleanup(subquery) with true argument too
and to tmp_table_param->field array cleanup which is required later.
The problem is that Item_func_set_user_var does not set
result_filed which leads to unnecessary repeated excution of subquery
on final stage.
The fix is to set result_field for Item_func_set_user_var.


mysql-test/r/count_distinct.result:
  test result
mysql-test/r/user_var.result:
  test result
mysql-test/t/count_distinct.test:
  test case
mysql-test/t/user_var.test:
  test case
sql/item_func.cc:
  At the end of execution top level join execution
  we cleanup this join with true argument.
  It leads to underlying join cleanup(subquery) with true argument too
  and to tmp_table_param->field array cleanup which is required later.
  The problem is that Item_func_set_user_var does not set
  result_filed which leads to unnecessary repeated excution of subquery
  on final stage.
  The fix is to set result_field for Item_func_set_user_var.

 int join_read_key(JOIN_TAB*)

The eq_ref access method TABLE_REF (accessed through 
JOIN_TAB) to save state and to track if this is the 
first row it finds or not.
This state was not reset on subquery re-execution
causing an assert.

Fixed by resetting the state before the subquery 
re-execution.

5.0 buffer overflow for ER_UPDATE_INFO, or truncated info message in 5.1
      
5.0.86 has a buffer overflow/crash, and 5.1.40 has a truncated message.
      
errmsg.txt contains this:
      
ER_UPDATE_INFO
rum "Linii identificate (matched): %ld  Schimbate: %ld  Atentionari 
(warnings): %ld"
When that is sprintf'd into a buffer of STRING_BUFFER_USUAL_SIZE size,
a buffer overflow can happen.
      
The solution to this is to use MYSQL_ERRMSG_SIZE for the buffer size, 
instead of STRING_BUFFER_USUAL_SIZE. This will allow longer strings. 
To avoid potential crashes, we will also use my_snprintf instead of
sprintf.

sql/sql_update.cc:
  sing MYSQL_ERRMSG_SIZE instead of STRING_BUFFER_USUAL_SIZE.
  Using my_snprintf instead of sprintf.

Windows 2000.
      
      Visual Studio 2003 and 2005 require
        _WIN32_WINNT >= 0x0500 (Win2000)  for TryEnterCriticalSection.

The help text for --init-slave=name:
"Command(s) that are executed when a slave connects to this master".
This text indicate that the --init-slave option is set on a  master 
server, and the master server passes the option's argument to slave 
which connects to it. This is wrong. Actually the --init-slave option 
just can be set on a slave server, and then the slave server executes 
the argument each time the SQL thread starts.

Correct the help text for --init-slave option as following:
"Command(s) that are executed by a slave server each time the SQL thread starts."


sql/mysqld.cc:
  Correct the help text for --init-slave option.

SPATIAL and FULLTEXT indexes don't support algorithm
selection. 
Disabled by creating a special grammar rule for these
in the parser.
Added some encasulation of duplicate parser code.

Part 2 : 
There was a special optimization on the ref access method for 
ORDER BY ... DESC that was set without actually looking on the type of the 
selected index for ORDER BY.
Fixed the SELECT ... ORDER BY .. DESC (it uses a different code path compared
to the ASC that has been fixed with the previous fix).

mysql-test/include/kill_query.inc:
  Error 1034 can be generated when change MyISAM table indexes was interrupted
mysql-test/r/rpl_killed_ddl.result:
  table t4 may not exists because the ALTER above was interrupted
mysql-test/t/rpl_killed_ddl.test:
  table t4 may not exists because the ALTER above was interrupted

There are three issues that caused rpl_killed_ddl fails sporadically
in pb2:

 1) thd->clear_error() was not called before create Query event
if operation is executed successfully.
 2) DATABASE d2 might do exist because the statement to CREATE or
ALTER it was killed
 3) because of bug 43353, kill the query that do DROP FUNCTION or
    DROP PROCEDURE can result in SP not found

This patch fixed all above issues by:
 1) Called thd->clear_error() if the operation succeeded.
 2) Add IF EXISTS to the DROP DATABASE d2 statement
 3) Temporarily disabled testing DROP FUNCTION/PROCEDURE IF EXISTS.

mysql-test/t/rpl_killed_ddl.test:
  DATABASE d2 might not exists, add IF EXITS to the DROP statement
sql/sql_db.cc:
  Called thd->clear_error() if the operation succeeded

solaris after a crash
      
This patch adds a Solaris-specific version of
print_stacktrace() which uses printstack(2), available on all
Solaris versions since Solaris 9. (While Solaris 11 adds
support for the glibc functions backtrace_*() as of
PSARC/2007/162, printstack() is used for consistency over all
Solaris versions.)

The symbol names are mangled, so use of c++filt may be
required as described in the MySQL documentation.


sql/stacktrace.c:
  Added Solaris-specific print_stacktrace().

field='const1' AND field='const2' in some cases

Building multiple equality predicates containing
a constant which is compared as a datetime (with a field)
we should take this fact into account and compare the 
constant with another possible constatns as datetimes 
as well.

E.g. for the
SELECT ... WHERE a='2001-01-01' AND a='2001-01-01 00:00:00'
we should compare '2001-01-01' with '2001-01-01 00:00:00' as
datetimes but not as strings.


mysql-test/r/select.result:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - test result.
mysql-test/t/select.test:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - test case.
sql/item_cmpfunc.cc:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - adding a constant to Item_equal compare it as
  a datetime value with stored one if there's a 
  date[time] field in a equality predicate.
sql/item_cmpfunc.h:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - adding a constant to Item_equal compare it as
  a datetime value with stored one if there's a 
  date[time] field in a equality predicate.
sql/sql_select.cc:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - adding a constant to Item_equal compare it as
  a datetime value with stored one if there's a 
  date[time] field in a equality predicate.

Test case cleanup.

mysql-test/r/ps.result:
  Test case cleanup for bug#48508.
mysql-test/t/ps.test:
  Test case cleanup for bug#48508.

Actually there is two different bugs.
The first one caused crash on queries with WHERE condition over views
containing WHERE condition. A wrong check for prepared statement phase led
to items for view fields being allocated in the execution memory and freed
at the end of execution. Thus the optimized WHERE condition refers to
unallocated memory on the second execution and server crashed.
The second one caused by the Item_cond::compile function not saving changes
it made to the item tree. Thus on the next execution changes weren't
reverted and server crashed on dereferencing of unallocated space.

The new helper function called is_stmt_prepare_or_first_stmt_execute
is added to the Query_arena class.
The find_field_in_view function now uses
is_stmt_prepare_or_first_stmt_execute() to check whether
newly created view items should be freed at the end of the query execution.
The Item_cond::compile function now saves changes it makes to item tree.

mysql-test/r/ps.result:
  Added a test case for the bug#48508.
mysql-test/t/ps.test:
  Added a test case for the bug#48508.
sql/item_cmpfunc.cc:
  Bug#48508: Crash on prepared statement re-execution.
  The Item_cond::compile function now saves changes it makes to item tree.
sql/sql_base.cc:
  Bug#48508: Crash on prepared statement re-execution.
  The find_field_in_view function now uses
  is_stmt_prepare_or_first_stmt_execute() to check whether
  newly created view items should be freed at the end of the query execution.
sql/sql_class.h:
  Bug#48508: Crash on prepared statement re-execution.
  The Query_arena::is_stmt_prepare_or_first_sp_execute function now correctly
  do its check.