1. 28 Jul, 2006 1 commit
    • kroki/tomash@moonlight.intranet's avatar
      Bug#16581: deadlock: server and client both read from connection in · d06001b1
      kroki/tomash@moonlight.intranet authored
                 'conc_sys' test
      
      Concurrent execution of SELECT involing at least two INFORMATION_SCHEMA
      tables, DROP DATABASE statement and DROP TABLE statement could have
      resulted in stalled connection for this SELECT statement.
      
      The problem was that for the first query of a join there was a race
      between select from I_S.TABLES and DROP DATABASE, and the error (no
      such database) was prepared to be send to the client, but the join
      processing was continued.  On second query to I_S.COLUMNS there was a
      race with DROP TABLE, but this error (no such table) was downgraded to
      warning, and thd->net.report_error was reset.  And so neither result
      nor error was sent to the client.
      
      The solution is to stop join processing once it is clear we are going
      to report a error, and also to downgrade to warnings file system errors
      like 'no such database' (unless we are in the 'SHOW' command), because
      I_S is designed not to use locks and the query to I_S should not abort
      if something is dropped in the middle.
      
      No test case is provided since this bug is a result of a race, and is
      timing dependant.  But we test that plain SHOW TABLES and SHOW COLUMNS
      give a error if there is no such database or a table respectively.
      d06001b1
  2. 17 Jul, 2006 2 commits
  3. 13 Jul, 2006 2 commits
    • kroki/tomash@moonlight.intranet's avatar
      Merge moonlight.intranet:/home/tomash/src/mysql_ab/mysql-5.0 · a3ea06db
      kroki/tomash@moonlight.intranet authored
      into  moonlight.intranet:/home/tomash/src/mysql_ab/mysql-5.0-bug18630
      a3ea06db
    • kroki/tomash@moonlight.intranet's avatar
      Bug#18630: Arguments of suid routine calculated in wrong security · 4272d1ef
      kroki/tomash@moonlight.intranet authored
                 context.
      
      Routine arguments were evaluated in the security context of the routine
      itself, not in the caller's context.
      
      The bug is fixed the following way:
      
        - Item_func_sp::find_and_check_access() has been split into two
          functions: Item_func_sp::find_and_check_access() itself only
          finds the function and check that the caller have EXECUTE privilege
          on it.  New function set_routine_security_ctx() changes security
          context for SUID routines and checks that definer have EXECUTE
          privilege too.
      
        - new function sp_head::execute_trigger() is called from
          Table_triggers_list::process_triggers() instead of
          sp_head::execute_function(), and is effectively just as the
          sp_head::execute_function() is, with all non-trigger related code
          removed, and added trigger-specific security context switch.
      
        - call to Item_func_sp::find_and_check_access() stays outside
          of sp_head::execute_function(), and there is a code in
          sql_parse.cc before the call to sp_head::execute_procedure() that
          checks that the caller have EXECUTE privilege, but both
          sp_head::execute_function() and sp_head::execute_procedure() call
          set_routine_security_ctx() after evaluating their parameters,
          and restore the context after the body is executed.
      4272d1ef
  4. 12 Jul, 2006 3 commits
  5. 11 Jul, 2006 8 commits
  6. 10 Jul, 2006 21 commits
  7. 09 Jul, 2006 2 commits
  8. 08 Jul, 2006 1 commit