1. 21 Mar, 2011 3 commits
  2. 18 Mar, 2011 1 commit
  3. 17 Mar, 2011 2 commits
  4. 16 Mar, 2011 4 commits
  5. 15 Mar, 2011 1 commit
    • Dmitry Shulga's avatar
      Fixed Bug#11764168 "56976: SEVERE DENIAL OF SERVICE IN PREPARED STATEMENTS". · 9320dca9
      Dmitry Shulga authored
      The problem was that server didn't check resulting size of prepared
      statement argument which was set using mysql_send_long_data() API.
      By calling mysql_send_long_data() several times it was possible
      to create overly big string and thus force server to allocate
      memory for it. There was no way to limit this allocation.
      
      The solution is to add check for size of result string against
      value of max_long_data_size start-up parameter. When intermediate
      string exceeds max_long_data_size value an appropriate error message
      is emitted.
      
      We can't use existing max_allowed_packet parameter for this purpose
      since its value is limited by 1GB and therefore using it as a limit
      for data set through mysql_send_long_data() API would have been an
      incompatible change. Newly introduced max_long_data_size parameter
      gets value from max_allowed_packet parameter unless its value is
      specified explicitly. This new parameter is marked as deprecated
      and will be eventually replaced by max_allowed_packet parameter.
      Value of max_long_data_size parameter can be set only at server
      startup.
      
      
      mysql-test/t/variables.test:
        Added checking for new start-up parameter max_long_data_size.
      sql/item.cc:
        Added call to my_message() when accumulated string exceeds
        max_long_data_size value. my_message() calls error handler
        that was installed in mysql_stmt_get_longdata before call
        to Item_param::set_longdata.
        
        The error handler then sets state, last_error and last_errno
        fields for current statement to values which correspond to
        error which was caught.
      sql/mysql_priv.h:
        Added max_long_data_size variable declaration.
      sql/mysqld.cc:
        Added support for start-up parameter 'max_long_data_size'.
        This parameter limits size of data which can be sent from
        client to server using mysql_send_long_data() API.
      sql/set_var.cc:
        Added variable 'max_long_data_size' into list of variables
        displayed by command 'show variables'.
      sql/sql_prepare.cc:
        Added error handler class Set_longdata_error_handler.
        This handler is used to catch any errors that can be
        generated during execution of Item_param::set_longdata().
        
        Source code snippet that makes checking for statement's state 
        during statement execution is moved from Prepared_statement::execute()
        to Prepared_statement::execute_loop() in order not to call
        set_parameters() when statement has failed during
        set_long_data() execution. If this hadn't been done
        the call to set_parameters() would have failed.
      tests/mysql_client_test.c:
        A testcase for the bug #56976 was added.
      9320dca9
  6. 14 Mar, 2011 1 commit
  7. 11 Mar, 2011 3 commits
    • Bjorn Munch's avatar
      merge from 5.1-mtr · 52cb0b1e
      Bjorn Munch authored
      52cb0b1e
    • Mayank Prasad's avatar
      BUG #11760210: 52596: SSL_CIPHER_LIST NOT SET OR RETURNED FOR "SHOW STATUS LIKE 'SSL_CIPHER_LIST'" · d2e36e42
      Mayank Prasad authored
      Issue:
            SSL_CIPHER set to a specific CIPHER name was not getting picked up by SHOW STATUS Command.
      
      Solution:
            If specific cipher name is specified, avoid overwriting of Cipher List with default Cipher names.
      
      
      extra/yassl/src/yassl_int.cpp:
        If user specified Cipher name is there, avoid populating default
        cipher names' list.
      mysql-test/r/ssl_cipher.result:
        Expected file for ssl_cipher.test test case
      mysql-test/t/ssl_cipher-master.opt:
        Server option file for ssl_cipher.test test case.
      mysql-test/t/ssl_cipher.test:
        Test case to verify that user specified SSL cipher name is shown in SHOW STATUS Command.
      d2e36e42
    • Bjorn Munch's avatar
      merge from 5.1 main · 782b44bc
      Bjorn Munch authored
      782b44bc
  8. 09 Mar, 2011 3 commits
  9. 08 Mar, 2011 1 commit
  10. 03 Mar, 2011 4 commits
    • unknown's avatar
      Merge from mysql-5.1.56-release · d2ac3542
      unknown authored
      d2ac3542
    • Alexander Barkov's avatar
      Bug 11766519 - 59648: MY_STRTOLL10_MB2: ASSERTION `(*ENDPTR - S) % 2 == 0' FAILED. · a1e9be8e
      Alexander Barkov authored
      Part 2. Function QUOTE() was not multi-byte safe.
      
        @ mysql-test/r/ctype_ucs.result
        @ mysql-test/t/ctype_ucs.test
        Adding tests
      
        @ sql/item_strfunc.cc
        Fixing Item_func_quote::val_str to be multi-byte safe.
      
        @ sql/item_strfunc.h
        Multiple size needed for quote characters to mbmaxlen
      a1e9be8e
    • Alexander Barkov's avatar
      BUG#11766519 (bug#59648): MY_STRTOLL10_MB2: ASSERTION `(*ENDPTR - S) % 2 == 0' FAILED · 1bc5e76e
      Alexander Barkov authored
            
      Problem: wrong character set pointer was passed to my_strtoll10_mb2,
      which led to DBUG_ASSERT failure in some cases.
      
        @ mysql-test/r/func_encrypt_ucs2.result
        @ mysql-test/t/func_encrypt_ucs2.test
        @ mysql-test/r/ctype_ucs.result
        @ mysql-test/t/ctype_ucs.test
        Adding tests
      
        @ sql/item_func.cc
        "cs" initialization was wrong (res does not necessarily point to &str_value)
      
        @ sql/item_strfunc.cc
        Item_func_dec_encrypt::val_str() and Item_func_des_descrypt::val_str()
        did not set character set for tmp_value (the returned value),
        so the old value, which was previously copied from args[1]->val_str(),
        was incorrectly returned with tmp_value.
      1bc5e76e
    • Alexander Barkov's avatar
      An after-fix for · 165660fd
      Alexander Barkov authored
      Bug#11765108 - Bug#58036: CLIENT UTF32, UTF16, UCS2 SHOULD BE DISALLOWED, THEY CRASH SERVER 
      
      Fixing wrong usage of DBUG_ASSERT.
      In non-debug version thd_init_client_charset
      was not executed at all.
      165660fd
  11. 01 Mar, 2011 2 commits
  12. 28 Feb, 2011 1 commit
  13. 24 Feb, 2011 1 commit
  14. 23 Feb, 2011 1 commit
  15. 22 Feb, 2011 2 commits
  16. 21 Feb, 2011 1 commit
    • Nirbhay Choubey's avatar
      Bug#11766310 : 59398: MYSQLDUMP 5.1 CAN'T HANDLE A DASH · 876502d7
      Nirbhay Choubey authored
                     ("-") IN DATABASE NAMES IN ALTER DATABASE.
      
      mysqldump did not quote database name in 'ALTER DATABASE'
      statements in its output. This can further cause a failure
      while loading if database name contains a hyphen '-'.
      
      This happened as, while printing the 'ALTER DATABASE'
      statements, the database name was not quoted.
      
      Fixed by quoting the database name.
      
      
      client/mysqldump.c:
        Bug#11766310 : 59398: MYSQLDUMP 5.1 CAN'T HANDLE A DASH
                       ("-") IN DATABASE NAMES IN ALTER DATABASE.
        
        Modified the print statement in order to print the quoted
        database name for 'ALTER DATABASE' statements.
      mysql-test/r/mysqldump.result:
        Added a test case for bug#11766310.
      mysql-test/t/mysqldump.test:
        Added a test case for bug#11766310.
      876502d7
  17. 18 Feb, 2011 4 commits
    • Alexander Barkov's avatar
      A post-fix for b58036. · e2e6eb8f
      Alexander Barkov authored
      e2e6eb8f
    • Alexander Barkov's avatar
      Bug#11765108 (Bug#58036) client utf32, utf16, ucs2 should be disallowed, they crash server · 5f55c232
      Alexander Barkov authored
      A separate fix for 5.1 (as 5.1 and 5.5 have seriously
      differged in the related pieces of the code).
      A patch for 5.5 was approved earlier.
      
      Problem: ucs2 was correctly disallowed in "SET NAMES" only,
      while mysql_real_connect() and mysql_change_user() still allowed
      to use ucs2, which made server crash.
      
      Fix: disallow ucs2 in mysql_real_connect() and mysql_change_user().
      
        @ sql/sql_priv.h
          - changing return type for thd_init_client_charset() to bool,
            to return errors to the caller
      
        @ sql/sql_var.cc
          - using new function
      
        @ sql/sql_connect.cc
          - thd_client_charset_init:
            in case of unsupported client character set send error and return true;
            in case of success return false
          - check_connection:
            Return error if character set initialization failed
      
        @ sql/sql_parse.cc
          - check charset in the very beginnig of the CMD_CHANGE_USER handling code
      
        @ tests/mysql_client_test.c
          - adding tests
      5f55c232
    • Vasil Dimov's avatar
      Merge mysql-5.1-innodb -> mysql-5.1 · 4b7a9247
      Vasil Dimov authored
      4b7a9247
    • Martin Hansson's avatar
      Bug#11766675 - 59839: Aggregation followed by subquery yields wrong result · 61b25617
      Martin Hansson authored
      The loop that was looping over subqueries' references to outer field used a
      local boolean variable to tell whether the field was grouped or not. But the
      implementor failed to reset the variable after each iteration. Thus a field
      that was not directly aggregated appeared to be.
      
      Fixed by resetting the variable upon each new iteration.
      61b25617
  18. 17 Feb, 2011 5 commits
    • Marko Mäkelä's avatar
    • Vasil Dimov's avatar
      Fix the non-determinism in innodb_information_schema.test · a27d85aa
      Vasil Dimov authored
      Thanks to Kristian Nielsen for finding out the root cause for the
      failure, see: https://bugs.launchpad.net/maria/+bug/677407
      a27d85aa
    • Vasil Dimov's avatar
      cc7b3de9
    • Vasil Dimov's avatar
      Merge mysql-5.1-innodb -> mysql-5.1 · 0bbaf6e8
      Vasil Dimov authored
      0bbaf6e8
    • Magne Mahre's avatar
      Bug#48053 String::c_ptr has a race and/or does an invalid · 65032267
      Magne Mahre authored
                memory reference
      
      There are two issues present here.
        1) There is a possibility that we test a byte beyond the
           allocated buffer
      
        2) We compare a byte that might never have been
           initalized to see if it's 0.
      
      The first issue is not triggered by existing code, but an
      ASSERT has been added to safe-guard against introducing
      new code that triggers it.
      
      The second issue is what triggers the Valgrind warnings
      reported in the bug report. A buffer is allocated in
      class String to hold the value. This buffer is populated
      by the character data constituting the string, but is not
      zero-terminated in most cases.  Testing if it is indeed
      zero-terminated means that we check a byte that has never
      been explicitly set, thus causing Valgrind to trigger.
      
      Note that issue 2 is not a serious problem.  The variable
      is read, and if it's not zero, we will set it to zero.
      There are no further consequences.
      
      Note that this patch does not fix the underlying problems
      with issue 1, as it is deemed too risky to fix at this
      point (as noted in the bug report).  As discussed in
      the report, the c_ptr() method should probably be
      replaced, but this requires a thorough analysis of the
      ~200 calls to the method.
      
      
      sql/set_var.cc:
        These two cases have been reported to fail
        with Valgrind.
      65032267